>pf.conf покажи #######################################################################
# pf v2.0
#######################################################################
ext_if = "tun0"
ext_ip = "82.207.XX.XX"
int_if = "rl0"
int_ip = "172.30.100.50"
modem_if1 = "rl1"
modem_ip1 = "192.168.1.2"
cool_ip = "172.30.100.200"
table <rfc1918> const { 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }
lan2me_tcp = "{ 20, 21, 22, 53 }"
lan2me_udp = "{ 53, 123 }"
icmp_types = "{ echoreq }"
#######################################################################
# -----------------------------------------------------------------------
# options
#set block-policy return
set loginterface $ext_if
# -----------------------------------------------------------------------
# Нормализачия пакетов
scrub in all
# -----------------------------------------------------------------------
# Включение правил NAT
nat on $ext_if from $int_if:network to any tag LAN2EXT_NAT -> ($ext_if)
# -----------------------------------------------------------------------
# filter rules - paranoid
block log all
# -----------------------------------------------------------------------
# Разрешаем прохождение пакетов на локальном интерфейсе
pass quick on lo0 all
#pass quick on $int_if all
# -----------------------------------------------------------------------
# antispoof
antispoof log for $int_if inet
# -----------------------------------------------------------------------
# block fakenet on external iface
block drop in quick log on $ext_if from <rfc1918> to any
block drop out quick log on $ext_if from any to <rfc1918>
pass quick on $modem_if1 all
#lan=>me_iface Разрешить входящие на интерфейс rl0 из локальной сети и установить политику LAN2ME
#
pass in on $int_if from $int_if:network to $int_ip tag LAN2ME keep state
pass in on $int_if from $cool_ip !tagged LAN2ME tag LAN2EXT keep state
#lan=>me
pass in quick on $int_if proto tcp to port $lan2me_tcp tagged LAN2ME keep state
pass in quick on $int_if proto udp to port $lan2me_udp tagged LAN2ME keep state
# -----------------------------------------------------------------------
# me=>all
#pass out on $ext_if from $ext_ip tag ME2EXT keep state
pass out on $ext_if from any tag ME2EXT keep state
pass out on $int_if from $int_ip tag ME2LAN keep state
# -----------------------------------------------------------------------
# Разрешить исходящие пакеты для tun0 интерфейса по правилам политик
#
pass out quick on $ext_if tagged LAN2EXT_NAT keep state
pass out quick on $ext_if tagged LAN2EXT keep state
pass out quick on $ext_if tagged ME2EXT keep state
# Разрешить исходящие пакеты для интерфейса rl0 по правилам политик
pass out quick on $int_if tagged ME2LAN keep state
# -----------------------------------------------------------------------
# icmp
#pass in quick inet proto icmp all icmp-type $icmp_types keep state
#pass out quick inet proto icmp all icmp-type $icmp_types keep state
pass quick inet proto icmp all icmp-type $icmp_types keep state