вроде так работает. прокоментируйте.
ext_if1 = "igb0"
ext_if2 = "vlan4"
ext_gw1 = "xx.xx.250.1"
ext_gw2 = "xx.xx.18.1"
lan_net = "10.0.0.0/8"
set limit states 16000000
set optimization aggressive
set limit src-nodes 160000
set limit table-entries 160000
nat-anchor "ftp-proxy/*"
nat on $ext_if1 from 10.6.0.0/20 to any -> $ext_if1
nat on $ext_if1 from 10.11.0.0/20 to any -> $ext_if1
nat on $ext_if1 from 10.13.0.0/20 to any -> $ext_if1
nat on $ext_if1 from 10.18.0.0/20 to any -> $ext_if1
nat on $ext_if2 from 10.8.0.0/20 to any -> $ext_if2
#проброс без балансировки (согласно списку адресов)
pass in quick on vlan6 route-to ($ext_if1 $ext_gw1) from 10.6.0.0/20 to !$lan_net keep state
pass in quick on vlan8 route-to ($ext_if2 $ext_gw2) from 10.8.0.0/20 to !$lan_net keep state
pass in quick on vlan11 route-to ($ext_if1 $ext_gw1) from 10.11.0.0/20 to !$lan_net keep state
pass in quick on vlan13 route-to ($ext_if1 $ext_gw1) from 10.13.0.0/20 to !$lan_net keep state
pass in quick on vlan18 route-to ($ext_if1 $ext_gw1) from 10.18.0.0/20 to !$lan_net keep state
# general "pass out" rules for external interfaces
pass out on $ext_if1 proto tcp from any to any flags S/SA modulate state
pass out on $ext_if1 proto { udp, icmp } from any to any keep state
pass out on $ext_if2 proto tcp from any to any flags S/SA modulate state
pass out on $ext_if2 proto { udp, icmp } from any to any keep state
# route packets from any IPs on $ext_if1 to $ext_gw1 and the same for $ext_if2 and $ext_gw2
pass out on $ext_if1 route-to ($ext_if2 $ext_gw2) from $ext_if2 to any
pass out on $ext_if2 route-to ($ext_if1 $ext_gw1) from $ext_if1 to any
Вариант для распечатки
(ok) on 12-Май-15, 14:12 
