Here is my pf.conf. I tried to slim it down as much as possible and in the same time preserve important informations in my opinion. I can reproduce what I said before with those lines.
table <reserved> { $private_nets } table <xcast> { $bcast_nets, $ext_if:broadcast } table <sshguard> persist table <torenodes> persist nat on $ext_if inet from $j2 to any port 53 -> ( $ext_if ) pass quick on lo0 from 127.0.0.1 to 127.0.0.1 pass quick on lo0 from $j2 to $j2 rtable 2 block log quick on lo0 block log quick on jsw1 pass out log quick on jsw2 proto udp from $j2 to $service1 port 53 rtable 0 pass out log quick on jsw2 proto udp from $j2 to $service1ext port 53 rtable 0 block log quick on jsw2 pass in quick on tun0 proto udp from $tun0net to $vcns port 53 rtable 0 pass quick on { tun0, tun1 } proto gre block log quick on tun0 block log quick on tun1 pass in quick on gre0 proto ospf from { $gre0vc, $gre0rsn } pass in quick on gre1 proto ospf from { $gre1vc, $gre1rsn } pass out quick on gre0 proto ospf from { $gre0vc, $gre0rsn } pass out quick on gre1 proto ospf from { $gre1vc, $gre1rsn } pass in quick on { gre0, gre1 } proto udp from $service1 to $vcns port 53 rtable 0 pass in quick on { gre0, gre1 } proto udp from $rsnnet2 to $vcns port 53 rtable 0 pass in quick on { gre0, gre1 } proto tcp from $service1 to $vcns port 53 rtable 0 pass in quick on { gre0, gre1 } proto tcp from $rsnnet2 to $vcns port 53 rtable 0 pass in quick on { gre0, gre1 } proto tcp from { $rsnnet1, $rsnnet2 } to $vcsrv port 22 pass quick on { gre0, gre1 } proto gre block log quick on gre0 block log quick on gre1 block log quick on gre2 block in quick on $ext_if from <sshguard> block in quick on $ext_if from <reserved> block in quick on $ext_if to <xcast> block in quick on $ext_if proto tcp from <torenodes> to $ext_ip port 22 pass in quick on $ext_if proto tcp from any to $ext_ip port 22 block in log quick on $ext_if to $ext_ip pass out quick on $ext_if from $ext_ip block out log quick on $ext_if from ! $ext_ip block log quick Maybe someone would see something I can't see myself. kaycee, _______________________________________________ freebsd-pf@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-pf To unsubscribe, send any mail to "freebsd-pf-unsubscr...@freebsd.org"