I try to describe a scenario, just encountered for CU173 stable. I do not know if it is normal and I do not know if it also occurs for CU174 test.
I set up 2 rules in the firewall:
The first one performs a port forward to local port 68nn for external IP 176.n.n.n avoiding creating the LOG.
The second performs a port forward to local port 68nn for all Italian external IPs, creating the LOG.
Despite these 2 rules, it seems from the LOGs that there are (from time to time) DROP_INPUT conditions for IP 176.n.n.n
Is this normal?