Re: Firewall blocking 10.68.16.1
 

Thats good ..... My objection is only for using the firewall as a packet filter behind a nat.... I have no problem with add filtering and app level control - In fact I am all for it :)

Re: Firewall blocking 10.68.16.1
 

Just to clear up some misapprehension earlier, both SACMs and STBs only have a single private IP address, although most SACMs also have an internal diagnostic IP which isn't routable.

10.68.16.1 is a private IP address on ubr 1 in Locksheath in Hampshire.

Re: Firewall blocking 10.68.16.1
 

Well, I can confirm that you do not need to talk to any 10.x.x.x addres to communicate from my sacm. I inadvertantly had the whole of the 10.x.x.x range being routed out to another server on my network for months, and it made no difference :)

Re: Firewall blocking 10.68.16.1
 

Basically because the firewall doesn't have a clue what is going on, and it misinterprets all the legitimate traffic from the cable head-end as being some sort of Denial of Service. Just ignore these log entries: 10.xxx.xxx.1 is a legitimate address for STB customers to be seeing traffic from.

The other address is probably to do with the MSM system trying to contact your MSM Messenger or Windows Messenger. If your router supports UPnP, then turn on UPnP support in the router, so that Messenger can configure the router to deal with this traffic rather than blocking it.

Re: Firewall blocking 10.68.16.1
 

That might well be the case for stand-alone cable modems, but it is certainly not true for customers fed via set-top boxes: they will need access to certain 10.xx.xx.xx range addresses.