I have set up the firewall as per guides to allow traffic only from a list of IP addresses through for RDP.
The server is seeing small traffic from an unknown IP so I was wondering if the firewall was working correctly.

When running the syslog utility User Access, WAN and Others are showing traffic, but there is nothing in any area of the Firewall tab.
On the syslog setup I ticked the box to forward all traffic including Firewall.

It's not even showing ICMP requests which I would expect to be seeing constantly.

Is the firewall working right?