I mean connecting to router via SSH from outside world.
80.232.198.21 - temporary external IP, eth0, ISp #1 (problematic)
80.232.198.17 - gateway IP ISP #1
sudo tcpdump -i eth0 | grep 80.232.198.21
vyos@linrt-aio:~$ sudo tcpdump -i eth0 | grep 80.232.198.21
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
13:07:03.965717 IP 80.232.198.21.20271 > dns.balticom.lv.domain: 19183+ PTR? 95.181.108.95.in-addr.arpa. (44)
13:07:05.959530 IP 80.232.198.21 > 80.232.198.17: ICMP echo request, id 13274, seq 256, length 40
13:07:05.999302 IP 80.232.198.17 > 80.232.198.21: ICMP echo reply, id 13274, seq 256, length 40
13:07:06.046294 IP balticom-228-190.balticom.lv.49142 > 80.232.198.21.10055: Flags [S], seq 84938726, win 29200, options [mss 1460,sackOK,TS val 1108397486 ecr 0,nop,wscale 7], length 0
13:07:06.901849 IP 80.232.198.21.44887 > ns12.lattelecom.lv.domain: 61981+ [b2&3=0x182] PTR? 203.66.244.216.in-addr.arpa. (45)
13:07:07.055152 IP balticom-228-190.balticom.lv.49142 > 80.232.198.21.10055: Flags [S], seq 84938726, win 29200, options [mss 1460,sackOK,TS val 1108398513 ecr 0,nop,wscale 7], length 0
13:07:07.055241 IP 80.232.198.21.10055 > balticom-228-190.balticom.lv.49142: Flags [S.], seq 3164082046, ack 84938727, win 28960, options [mss 1460,sackOK,TS val 15781950 ecr 1108397486,nop,wscale 7], length 0
13:07:07.067755 IP balticom-228-190.balticom.lv.49142 > 80.232.198.21.10055: Flags [.], ack 1, win 229, options [nop,nop,TS val 1108398532 ecr 15781950], length 0
13:07:07.067860 IP balticom-228-190.balticom.lv.49142 > 80.232.198.21.10055: Flags [P.], seq 1:22, ack 1, win 229, options [nop,nop,TS val 1108398533 ecr 15781950], length 21
13:07:09.407088 IP balticom-228-190.balticom.lv.49142 > 80.232.198.21.10055: Flags [P.], seq 1:22, ack 1, win 229, options [nop,nop,TS val 1108400881 ecr 15781950], length 21
13:07:10.963351 ARP, Request who-has 80.232.198.17 tell 80.232.198.21, length 28
13:07:11.011771 IP 80.232.198.21 > 80.232.198.17: ICMP echo request, id 13274, seq 256, length 40
13:07:11.014312 IP 80.232.198.17 > 80.232.198.21: ICMP echo reply, id 13274, seq 256, length 40
13:07:11.887343 IP 80.232.198.21.44887 > dns.balticom.lv.domain: 61981+ PTR? 203.66.244.216.in-addr.arpa. (45)
13:07:11.887470 IP 80.232.198.21.44887 > google-public-dns-a.google.com.domain: 61981+ PTR? 203.66.244.216.in-addr.arpa. (45)
13:07:11.948067 IP google-public-dns-a.google.com.domain > 80.232.198.21.44887: 61981 ServFail 0/0/0 (45)
13:07:12.735195 IP balticom-228-190.balticom.lv.49142 > 80.232.198.21.10055: Flags [P.], seq 1:22, ack 1, win 229, options [nop,nop,TS val 1108404209 ecr 15781950], length 21
13:07:16.027182 IP 80.232.198.21 > 80.232.198.17: ICMP echo request, id 13274, seq 256, length 40
13:07:16.029850 IP 80.232.198.17 > 80.232.198.21: ICMP echo reply, id 13274, seq 256, length 40
13:07:19.135014 IP balticom-228-190.balticom.lv.49142 > 80.232.198.21.10055: Flags [P.], seq 1:22, ack 1, win 229, options [nop,nop,TS val 1108410609 ecr 15781950], length 21
13:07:21.043089 IP 80.232.198.21 > 80.232.198.17: ICMP echo request, id 13274, seq 256, length 40
13:07:21.047480 IP 80.232.198.17 > 80.232.198.21: ICMP echo reply, id 13274, seq 256, length 40
13:07:22.011701 IP 80.232.198.21.ntp > ntp1.0x00.lv.ntp: NTPv4, Client, length 48
13:07:22.012314 IP 80.232.198.21.26611 > google-public-dns-a.google.com.domain: 54016+ PTR? 85.54.111.89.in-addr.arpa. (43)
13:07:22.014574 IP ntp1.0x00.lv.ntp > 80.232.198.21.ntp: NTPv4, Server, length 48
13:07:22.033622 IP google-public-dns-a.google.com.domain > 80.232.198.21.26611: 54016 1/0/0 PTR ntp1.0x00.lv. (69)
13:07:24.011826 IP 80.232.198.21.ntp > ntp1.0x00.lv.ntp: NTPv4, Client, length 48
13:07:24.014944 IP ntp1.0x00.lv.ntp > 80.232.198.21.ntp: NTPv4, Server, length 48
13:07:26.059213 IP 80.232.198.21 > 80.232.198.17: ICMP echo request, id 13274, seq 256, length 40
13:07:26.061608 IP 80.232.198.17 > 80.232.198.21: ICMP echo reply, id 13274, seq 256, length 40
13:07:29.539210 IP census10.shodan.io.31743 > 80.232.198.21.chargen: UDP, length 1
13:07:29.539789 IP 80.232.198.21.16979 > google-public-dns-a.google.com.domain: 27523+ PTR? 6.105.221.82.in-addr.arpa. (43)
13:07:29.539974 IP 80.232.198.21.16979 > ns12.lattelecom.lv.domain: 27523+ PTR? 6.105.221.82.in-addr.arpa. (43)
13:07:29.543066 IP ns12.lattelecom.lv.domain > 80.232.198.21.16979: 27523 1/3/3 PTR census10.shodan.io. (180)
13:07:29.551934 IP google-public-dns-a.google.com.domain > 80.232.198.21.16979: 27523 1/0/0 PTR census10.shodan.io. (75)
13:07:31.073710 IP 80.232.198.21 > 80.232.198.17: ICMP echo request, id 13274, seq 256, length 40
13:07:31.076538 IP 80.232.198.17 > 80.232.198.21: ICMP echo reply, id 13274, seq 256, length 40
13:07:31.935416 IP balticom-228-190.balticom.lv.49142 > 80.232.198.21.10055: Flags [P.], seq 1:22, ack 1, win 229, options [nop,nop,TS val 1108423409 ecr 15781950], length 21
13:07:32.011785 IP 80.232.198.21.ntp > ntp1.0x00.lv.ntp: NTPv4, Client, length 48
13:07:32.014994 IP ntp1.0x00.lv.ntp > 80.232.198.21.ntp: NTPv4, Server, length 48
13:07:36.088930 IP 80.232.198.21 > 80.232.198.17: ICMP echo request, id 13274, seq 256, length 40
13:07:36.091790 IP 80.232.198.17 > 80.232.198.21: ICMP echo reply, id 13274, seq 256, length 40
13:07:36.905145 IP ns12.lattelecom.lv.domain > 80.232.198.21.44887: 61981 ServFail 0/0/0 (45)
13:07:41.103294 IP 80.232.198.21 > 80.232.198.17: ICMP echo request, id 13274, seq 256, length 40
13:07:41.107357 IP 80.232.198.17 > 80.232.198.21: ICMP echo reply, id 13274, seq 256, length 40
13:07:42.274246 IP 80.232.198.21.47075 > google-public-dns-a.google.com.domain: 51410+ PTR? 149.47.125.74.in-addr.arpa. (44)
13:07:42.274373 IP 80.232.198.21.47075 > ns12.lattelecom.lv.domain: 51410+ PTR? 149.47.125.74.in-addr.arpa. (44)
13:07:42.294781 IP ns12.lattelecom.lv.domain > 80.232.198.21.47075: 51410 NXDomain 0/1/0 (104)
13:07:42.296004 IP google-public-dns-a.google.com.domain > 80.232.198.21.47075: 51410 NXDomain 0/1/0 (104)
13:07:42.296068 IP 80.232.198.21 > google-public-dns-a.google.com: ICMP 80.232.198.21 udp port 47075 unreachable, length 140
13:07:42.339250 IP 80.232.198.21.58603 > dns.balticom.lv.domain: 25972+ PTR? 84.73.125.74.in-addr.arpa. (43)
13:07:46.122805 IP 80.232.198.21 > 80.232.198.17: ICMP echo request, id 13274, seq 256, length 40
13:07:46.125818 IP 80.232.198.17 > 80.232.198.21: ICMP echo reply, id 13274, seq 256, length 40
13:07:47.344739 IP 80.232.198.21.58603 > ns12.lattelecom.lv.domain: 25972+ PTR? 84.73.125.74.in-addr.arpa. (43)
13:07:47.344861 IP 80.232.198.21.58603 > dns.balticom.lv.domain: 25972+ PTR? 84.73.125.74.in-addr.arpa. (43)
13:07:47.364897 IP ns12.lattelecom.lv.domain > 80.232.198.21.58603: 25972 NXDomain 0/1/0 (103)
13:07:51.137330 IP 80.232.198.21 > 80.232.198.17: ICMP echo request, id 13274, seq 256, length 40
13:07:51.140898 IP 80.232.198.17 > 80.232.198.21: ICMP echo reply, id 13274, seq 256, length 40
13:07:56.156649 IP 80.232.198.21 > 80.232.198.17: ICMP echo request, id 13274, seq 256, length 40
13:07:56.159635 IP 80.232.198.17 > 80.232.198.21: ICMP echo reply, id 13274, seq 256, length 40
13:07:57.535024 IP balticom-228-190.balticom.lv.49142 > 80.232.198.21.10055: Flags [P.], seq 1:22, ack 1, win 229, options [nop,nop,TS val 1108449009 ecr 15781950], length 21
13:08:01.170961 IP 80.232.198.21 > 80.232.198.17: ICMP echo request, id 13274, seq 256, length 40
13:08:01.173807 IP 80.232.198.17 > 80.232.198.21: ICMP echo reply, id 13274, seq 256, length 40
13:08:06.187774 IP 80.232.198.21 > 80.232.198.17: ICMP echo request, id 13274, seq 256, length 40
13:08:06.190826 IP 80.232.198.17 > 80.232.198.21: ICMP echo reply, id 13274, seq 256, length 40
13:08:11.202360 IP 80.232.198.21 > 80.232.198.17: ICMP echo request, id 13274, seq 256, length 40
13:08:11.206628 IP 80.232.198.17 > 80.232.198.21: ICMP echo reply, id 13274, seq 256, length 40
13:08:16.226918 IP 80.232.198.21 > 80.232.198.17: ICMP echo request, id 13274, seq 256, length 40
13:08:16.230011 IP 80.232.198.17 > 80.232.198.21: ICMP echo reply, id 13274, seq 256, length 40
13:08:21.250175 IP 80.232.198.21 > 80.232.198.17: ICMP echo request, id 13274, seq 256, length 40
13:08:21.252842 IP 80.232.198.17 > 80.232.198.21: ICMP echo reply, id 13274, seq 256, length 40
13:08:26.264517 IP 80.232.198.21 > 80.232.198.17: ICMP echo request, id 13274, seq 256, length 40
13:08:26.267376 IP 80.232.198.17 > 80.232.198.21: ICMP echo reply, id 13274, seq 256, length 40
13:08:29.011730 IP 80.232.198.21.ntp > ntp1.0x00.lv.ntp: NTPv4, Client, length 48
13:08:29.014756 IP ntp1.0x00.lv.ntp > 80.232.198.21.ntp: NTPv4, Server, length 48
13:08:29.143854 IP 80.232.198.21.41659 > dns.balticom.lv.domain: 54158+ PTR? 147.66.249.66.in-addr.arpa. (44)
13:08:31.279203 IP 80.232.198.21 > 80.232.198.17: ICMP echo request, id 13274, seq 256, length 40
13:08:31.283193 IP 80.232.198.17 > 80.232.198.21: ICMP echo reply, id 13274, seq 256, length 40
13:08:36.294596 IP 80.232.198.21 > 80.232.198.17: ICMP echo request, id 13274, seq 256, length 40
13:08:36.298061 IP 80.232.198.17 > 80.232.198.21: ICMP echo reply, id 13274, seq 256, length 40
13:08:36.667565 IP 80.232.198.21.39288 > google-public-dns-a.google.com.domain: 47961+ PTR? 162.126.171.112.in-addr.arpa. (46)
13:08:37.285470 IP google-public-dns-a.google.com.domain > 80.232.198.21.39288: 47961 NXDomain 0/1/0 (107)
13:08:41.309279 IP 80.232.198.21 > 80.232.198.17: ICMP echo request, id 13274, seq 256, length 40
13:08:41.312317 IP 80.232.198.17 > 80.232.198.21: ICMP echo reply, id 13274, seq 256, length 40
13:08:46.323962 IP 80.232.198.21 > 80.232.198.17: ICMP echo request, id 13274, seq 256, length 40
13:08:46.326648 IP 80.232.198.17 > 80.232.198.21: ICMP echo reply, id 13274, seq 256, length 40
13:08:48.735333 IP balticom-228-190.balticom.lv.49142 > 80.232.198.21.10055: Flags [P.], seq 1:22, ack 1, win 229, options [nop,nop,TS val 1108500210 ecr 15781950], length 21
13:08:48.735436 IP 80.232.198.21.10055 > balticom-228-190.balticom.lv.49142: Flags [.], ack 22, win 227, options [nop,nop,TS val 15792118 ecr 1108500210,nop,nop,sack 1 {1:22}], length 0
13:08:51.338112 IP 80.232.198.21 > 80.232.198.17: ICMP echo request, id 13274, seq 256, length 40
13:08:51.341197 IP 80.232.198.17 > 80.232.198.21: ICMP echo reply, id 13274, seq 256, length 40
13:08:56.352864 IP 80.232.198.21 > 80.232.198.17: ICMP echo request, id 13274, seq 256, length 40
13:08:56.357027 IP 80.232.198.17 > 80.232.198.21: ICMP echo reply, id 13274, seq 256, length 40
13:09:01.368079 IP 80.232.198.21 > 80.232.198.17: ICMP echo request, id 13274, seq 256, length 40
13:09:01.371944 IP 80.232.198.17 > 80.232.198.21: ICMP echo reply, id 13274, seq 256, length 40
13:09:04.993392 IP 80.232.198.21.10055 > balticom-228-190.balticom.lv.49142: Flags [P.], seq 1:826, ack 22, win 227, options [nop,nop,TS val 15793744 ecr 1108500210], length 825
13:09:04.997597 IP balticom-228-190.balticom.lv.49142 > 80.232.198.21.10055: Flags [.], ack 826, win 251, options [nop,nop,TS val 1108516472 ecr 15793744], length 0
13:09:04.999545 IP balticom-228-190.balticom.lv.49142 > 80.232.198.21.10055: Flags [P.], seq 22:1382, ack 826, win 251, options [nop,nop,TS val 1108516473 ecr 15793744], length 1360
^C318 packets captured
318 packets received by filter
0 packets dropped by kernel