What about this:
- they are a bug in default DROP, where REJECT is used for port 43, so you can block it with a DROP rule at the end of your rules.
(this is fixed in proxmox7).
from https://forum.proxmox.com/threads/proxmox-claiming-mac-address.52601/page-7#post-422371