на внешних интерфейсах на udp 1195 слушает openvpn. когда клиент коннектится к ext_if - то все нормально, а если на ext_if_2 , то все равно ответы от openvpn уходят через ext_if, хотя ответы по 53 порту уходят правильно. в чем я допустил ошибку?
PS: в коде не получается выделить текст.
Код: Выделить всё
ext_if = "em0"
ext_if_2 = "rl0"
vpn_if = "{tun0 tun1}"
vpn_if_2 = "tun1"
int_if = "fxp0"
int_if_2 = "rl1"
tcp_svc = "http 1494 ssh 1195"
[b]udp_svc = "domain 1195"[/b]
table <BRUTEFORCERS> persist
table <TO_NCPORT> persist file "/etc/pf.tables.ncport"
table <not_squid> const {192.168.0.0/16, 80.240.209.xx, 62.5.188.xx}
set block-policy return
set skip on lo0
set timeout { frag 10, tcp.established 3600 }
scrub in no-df
nat on $ext_if from 192.168.0.0/16 -> ($ext_if:0)
nat on $ext_if_2 from 192.168.0.0/16 -> ($ext_if_2:0)
#nat on $ext_if from !(self) -> ($ext_if:0)
#nat on $ext_if_2 from !(self) -> ($ext_if_2:0)
rdr on $ext_if_2 proto tcp from any to $ext_if_2 port 1494 tag EXT_IF_2 -> 192.168.7.4
rdr on $ext_if proto tcp from any to $ext_if port 1494 tag EXT_IF_1 -> 192.168.7.4
rdr on $ext_if proto tcp from any to $ext_if port smtp tag EXT_IF_1 -> 192.168.0.74
rdr on $ext_if proto tcp from any to $ext_if port http tag EXT_IF_1 -> 192.168.0.78
rdr on $ext_if_2 proto tcp from any to $ext_if_2 port smtp tag EXT_IF_2 -> 192.168.0.74
rdr on $ext_if_2 proto tcp from any to $ext_if_2 port http tag EXT_IF_2 -> 192.168.0.78
rdr on $int_if proto tcp from any to {$ext_if $ext_if_2} port http tag INT_IF_RDR -> 192.168.0.78
nat on $int_if tagged INT_IF_RDR -> ($int_if:0)
no rdr on $int_if proto tcp from <TO_NCPORT> to port 80
rdr on $int_if proto tcp from 192.168.0.0/24 to !<not_squid> port 80 -> 127.0.0.1 port 8080
rdr-anchor "NAV_to_6"
load anchor "NAV_to_6" from "/etc/pf.anchor.NAV_to_6"
block on {$ext_if $ext_if_2}
block return on {$ext_if $ext_if_2} inet proto tcp
block in quick on {$ext_if $ext_if_2} from <BRUTEFORCERS> to any
block in on $int_if_2 from 192.168.6.0/24 to any
pass out quick route-to ($ext_if 80.240.209.1) inet proto udp from $ext_if port 1195
pass out quick route-to ($ext_if 80.240.209.1) inet from $ext_if
pass out quick route-to ($ext_if_2 62.5.188.1) inet from $ext_if_2
pass in quick from ($ext_if_2:network) tagged EXT_IF_2
pass in quick reply-to ($ext_if_2 62.5.188.1) tagged EXT_IF_2
pass in quick reply-to ($ext_if 80.240.209.1) tagged EXT_IF_1
pass in quick from ($ext_if:network) tagged EXT_IF_1
pass in quick reply-to ($ext_if_2 62.5.188.1) tagged EXT_IF_2
pass in quick from ($ext_if_2:network) tagged EXT_IF_2
pass in on $ext_if reply-to ($ext_if 80.240.209.1) inet proto icmp \
to ($ext_if) icmp-type echoreq code 0
pass in on $ext_if inet proto icmp from ($ext_if:network) \
to ($ext_if) icmp-type echoreq code 0
pass in on $ext_if_2 reply-to ($ext_if_2 62.5.188.1) inet proto icmp \
to ($ext_if_2) icmp-type echoreq code 0
pass in on $ext_if_2 inet proto icmp from ($ext_if_2:network) \
to ($ext_if_2) icmp-type echoreq code 0
pass in quick on $ext_if reply-to ($ext_if 80.240.209.1) inet proto tcp \
to $ext_if port ssh modulate state ( max-src-conn 10, max-src-conn-rate 5/120, \
overload <BRUTEFORCERS> flush global )
pass in quick on $ext_if_2 reply-to ($ext_if_2 62.5.188.1) inet proto tcp \
to $ext_if_2 port ssh modulate state ( max-src-conn 10, max-src-conn-rate 5/120, \
overload <BRUTEFORCERS> flush global )
pass in on $ext_if reply-to ($ext_if 80.240.209.1) inet proto tcp \
to ($ext_if) port { $tcp_svc }
pass in on $ext_if inet proto tcp from ($ext_if:network) \
to ($ext_if) port { $tcp_svc }
pass in on $ext_if_2 reply-to ($ext_if_2 62.5.188.1) inet proto tcp \
to ($ext_if_2) port { $tcp_svc }
pass in on $ext_if_2 inet proto tcp from ($ext_if_2:network) \
to ($ext_if_2) port { $tcp_svc }
pass in on $ext_if reply-to ($ext_if 80.240.209.1) inet proto udp \
to ($ext_if) port { $udp_svc }
pass in on $ext_if inet proto udp from ($ext_if:network) \
to ($ext_if) port { $udp_svc }
[b]pass in on $ext_if_2 reply-to ($ext_if_2 62.5.188.1) inet proto udp \
to $ext_if_2 port { $udp_svc }[/b]
pass in on $ext_if_2 inet proto udp from ($ext_if_2:network) \
to $ext_if_2 port { $udp_svc }
pass in quick on $int_if route-to ($ext_if_2 62.5.188.1) proto tcp from {192.168.0.74 192.168.0.78 192.168.0.11} to any port smtp
block in log quick on $int_if proto tcp from 192.168.0.0/16 to any port smtp
pass in quick on $int_if route-to ($int_if 192.168.0.74) from <TO_NCPORT> to !192.168.0.0/16 no state
pass in on $int_if proto tcp from $int_if:network to any
pass on $vpn_if
pass in on $int_if_2 proto icmp from 192.168.6.40/32 to any icmp-type echoreq
pass in on $int_if_2 proto udp from 192.168.6.40/32 to any port domain
pass out on $int_if_2
#pass in quick on $int_if route-to ($ext2_if 62.5.188.1) proto tcp from { 192.168.0.11, 192.168.0.74 } to any port smtp
pass on $int_if
