PF and DHCP issues with Mac Mini Server

If your server is behind NAT, there is almost certainly no need for packet filtering and you should disable it. With a stateful firewall, there will always be some blocked TCP packets that arrive out of order, after a connection has been torn down.

> If your server is behind NAT, there is almost certainly no need for packet filtering and you should disable it.

I disagree, Linc. PF is very useful to block known bad IPs and brute force attacks, which are an hourly occurrence, especially on ssh. I use this PF configuration for OS X, which blocks brute force attacks, updates IP blocks from emergingthreats.net, and more. My logs and pf table "bruteforce" are full of attacks and blocked sites (sudo pfctl -t bruteforce -Ts). I also run snort on OS X and can see that the snort alert triggers are greatly reduced by simply blocking all these packets at the network layer.

Macs make comparatively poor IP routers and firewalls, and always have.

See the many previous discussions of the pain and grief involved here in the forums and on some of the mailing lists, and spend a small amount and get yourself (for instance) a ZyXEL ZYWALL USG box or equivalent.

FWIW, I've been installing ZyXEL USG boxes lately. They're definitely not introductory-grade devices and do expect some knowledge of IP and firewalls and VPNs, but they're comparatively cheap, effective, and have consistent and cogent user interfaces. (nb: I have no financial affiliations with ZyXEL, beyond having purchased ZyXEL gear.)

Macs as routers and firewalls are potentially vulnerable to local reconfigurations, too. Most folks don't alter with the firewall settings and the firewall context on anything approaching a daily or weekly basis, but updates and software reconfigurations are common on OS X and OS X Server; when folks are logged into the system and are tweaking configuration details and updating software — and might not be considering what's open and web-facing.

As I wrote earlier, the log messages represent out-of-order packets returned from a remote host (in that example, a mail server) after the TCP connection has been closed. That's normal with a stateful firewall. If you don't have a functional problem, you can ignore the messages.