была уже такая тема, хотел писать туда, но она уже закрыта, ответа там не нашел
есть
Код: Выделить всё
FreeBSD gate 8.0-RELEASE FreeBSD 8.0-RELEASE #4: Wed Mar 16 15:33:31 MSK 2011 admin@gate:/usr/obj/usr/src/sys/gate i386
проблема: после установления соединения (после обрыва), нет инета. пинг не ходит
ping: sendto: Operation not permitted
проблема решается руками pfctl -f /etc/pf.conf или ребутом серва
но не могу понять ПОЧЕМУ и как от этого избавиться
вот текущие правила и -sa когда инет работает
Код: Выделить всё
nat on tun0 inet from 192.168.0.0/24 to any -> x.x.x.x
scrub in on tun0 all fragment reassemble
block drop log all
pass out on tun0 inet proto udp from any to any port = domain keep state
pass out on tun0 inet proto udp from x.x.x.x to any port = bootps keep state
pass out on tun0 inet proto icmp from x.x.x.x to any keep state
pass out on tun0 inet proto tcp from x.x.x.x to any port = http flags S/SA keep state
pass out on tun0 inet proto tcp from x.x.x.x to any port = 8080 flags S/SA keep state
pass out on tun0 inet proto tcp from x.x.x.x to any port = https flags S/SA keep state
pass out on tun0 inet proto tcp from x.x.x.x to any port = imaps flags S/SA keep state
pass out on tun0 inet proto tcp from x.x.x.x to any port = smtps flags S/SA keep state
pass out on tun0 inet proto tcp from x.x.x.x to any port = submission flags S/SA keep state
pass out on tun0 inet proto tcp from x.x.x.x to any port = smtp flags S/SA keep state
pass out on tun0 inet proto tcp from x.x.x.x to any port = pop3 flags S/SA keep state
pass out on tun0 inet proto tcp from x.x.x.x to any port = aol flags S/SA keep state
block drop out on tun0 inet proto tcp from x.x.x.x to <vk>
INFO:
Status: Enabled for 3 days 02:06:33 Debug: Urgent
State Table Total Rate
current entries 173
searches 2016428 7.6/s
inserts 26848 0.1/s
removals 26675 0.1/s
Counters
match 55603 0.2/s
bad-offset 0 0.0/s
fragment 0 0.0/s
short 0 0.0/s
normalize 0 0.0/s
memory 0 0.0/s
bad-timestamp 0 0.0/s
congestion 0 0.0/s
ip-option 0 0.0/s
proto-cksum 2 0.0/s
state-mismatch 49 0.0/s
state-insert 0 0.0/s
state-limit 0 0.0/s
src-limit 0 0.0/s
synproxy 0 0.0/s
TIMEOUTS:
tcp.first 120s
tcp.opening 30s
tcp.established 86400s
tcp.closing 900s
tcp.finwait 45s
tcp.closed 90s
tcp.tsdiff 30s
udp.first 60s
udp.single 30s
udp.multiple 60s
icmp.first 20s
icmp.error 10s
other.first 60s
other.single 30s
other.multiple 60s
frag 30s
interval 10s
adaptive.start 6000 states
adaptive.end 12000 states
src.track 0s
LIMITS:
states hard limit 10000
src-nodes hard limit 10000
frags hard limit 5000
tables hard limit 1000
table-entries hard limit 200000
TABLES:
vk
OS FINGERPRINTS:
696 fingerprints loaded
Код: Выделить всё
State Table Total Rate
current entries 2
searches 1791361 6.9/s
inserts 20553 0.1/s
removals 20551 0.1/s
Counters
match 48802 0.2/s
bad-offset 0 0.0/s
fragment 0 0.0/s
short 0 0.0/s
normalize 0 0.0/s
memory 0 0.0/s
bad-timestamp 0 0.0/s
congestion 0 0.0/s
ip-option 0 0.0/s
proto-cksum 2 0.0/s
state-mismatch 26 0.0/s
state-insert 0 0.0/s
state-limit 0 0.0/s
src-limit 0 0.0/s
synproxy 0 0.0/s
TIMEOUTS:
tcp.first 120s
tcp.opening 30s
tcp.established 86400s
tcp.closing 900s
tcp.finwait 45s
tcp.closed 90s
tcp.tsdiff 30s
udp.first 60s
udp.single 30s
udp.multiple 60s
icmp.first 20s
icmp.error 10s
other.first 60s
other.single 30s
other.multiple 60s
frag 30s
interval 10s
adaptive.start 6000 states
adaptive.end 12000 states
src.track 0s
LIMITS:
states hard limit 10000
src-nodes hard limit 10000
frags hard limit 5000
tables hard limit 1000
table-entries hard limit 200000
TABLES:
vk
OS FINGERPRINTS:
696 fingerprints loaded
сеть маленькая, меньше 10 компов
