Hi Andrius
No, they are incoming. The firewall doesn’t block outgoing connections.
Detail of 1 entry
source 95.85.19.244 hostname discovery-v4-4.syncthing.net port 443 destination 192.168.nnn.xxx port 58872
(as it is the UFW log on the local machine, 192.168.nnn.xxx is the lan address of this machine running syncthing)
In fact, I wonder how it reaches syncthing given that it is connecting to an (apparently) random port. Unless these are probes left over from earlier now expired connections which set that port.