# Macros: define common values, so they can be referenced and changed easily.
ext_if="dc0"
int_if="xl0"
ppp_if="ppp0"
tun_if="tun0"
external_net="A.B.C.0/24"
internal_net="192.168.1/24"
external_addr="A.B.C.162"
tcp_svcs="{ 22, 25, 110, 113, 143, 443, 80, 53, 993 }"
udp_svcs="{ 53, 514, 9991 }"
loop="lo0"

# Tables: similar to macros, but more flexible for many addresses.
# table <foo> { 10.0.0.0/8, !10.1.0.0/16, 192.168.0.0/24, 192.168.1.18 }
table <rfc1918> { 10/8, 172.16/12, 192.168/16, !192.168.21.100 }
table <draft>   { 0/8, 127/8, 169.254/16, 192.0.2/24, 204.152.64/23, 224/3 }

# Options: tune the behavior of pf, default values are given.
#set timeout { interval 30, frag 10 }
#set timeout { tcp.first 120, tcp.opening 30, tcp.established 86400 }
#set timeout { tcp.closing 900, tcp.finwait 45, tcp.closed 90 }
#set timeout { udp.first 60, udp.single 30, udp.multiple 60 }
#set timeout { icmp.first 20, icmp.error 10 }
#set timeout { other.first 60, other.single 30, other.multiple 60 }
#set limit { states 10000, frags 5000 }
#set loginterface none
#set optimization normal
#set block-policy drop
#set require-order yes

set block-policy return
set loginterface $ext_if

# Normalization: reassemble fragments and resolve or reduce traffic ambiguities.
scrub in all

### Queueing: rule-based bandwidth control.
###altq on $ext_if bandwidth 2Mb cbq queue { dflt, developers, marketing }
###queue dflt bandwidth 5% cbq(default)
###queue developers bandwidth 80%
###queue marketing  bandwidth 15%

# Translation: specify how addresses are to be mapped or redirected.
# nat: packets going out through $ext_if with source address $internal_net will
# get translated as coming from the address of $ext_if, a state is created for
# such packets, and incoming packets will be redirected to the internal address.
nat on $ext_if from $internal_net to any -> ($ext_if)
nat on $ext_if from 192.168.5.0/24 to any -> ($ext_if)

# rdr: packets coming in on $ext_if with destination $external_addr:1234 will
# be redirected to 10.1.1.1:5678. A state is created for such packets, and
# outgoing packets will be translated as coming from the external address.
#rdr on $ext_if proto tcp from any to $external_addr/32 port 1234 -> 10.1.1.1 port 5678

# rdr outgoing FTP requests to the ftp-proxy
#rdr on $int_if proto tcp from any to any port ftp -> 127.0.0.1 port 8021

# spamd-setup puts addresses to be redirected into table <spamd>.
#table <spamd> persist
#no rdr on { lo0, lo1 } from any to any
#rdr inet proto tcp from <spamd> to any port smtp -> 127.0.0.1 port 8025

# Filtering: the implicit first two rules are
# connections and keep state, logging blocked packets.
#block in log  all

block             out log on $ext_if           all
block             in  log on $ext_if           all
block return-rst  out log on $ext_if proto tcp all
block return-rst  in  log on $ext_if proto tcp all
block return-icmp out log on $ext_if proto udp all
block return-icmp in  log on $ext_if proto udp all

block in  quick inet6 all
block out quick inet6 all

pass in  quick on $loop all
pass out quick on $loop all

# Immediate blocks
# fuzz any 'nmap' attempts
block in log quick on $ext_if inet proto tcp from any to any flags FUP/FUP
block in log quick on $ext_if inet proto tcp from any to any flags SF/SFRA
block in log quick on $ext_if inet proto tcp from any to any flags /SFRA

block in  log quick on $ext_if from <rfc1918> to any
block out log quick on $ext_if from any to <rfc1918>

block in  log quick on $ext_if from <draft> to any
block out log quick on $ext_if from any to <draft>

block out log quick on $ext_if inet from ! ($ext_if) to any

#
pass in on $ext_if inet proto tcp from 213.221.1.0/24 to $ext_if port 389 \
flags S/SA keep state
pass in on $ext_if inet proto tcp from any to $ext_if port $tcp_svcs \
flags S/SA keep state
pass in on $ext_if inet proto udp from any to $ext_if port $udp_svcs \
keep state

pass out       on $ext_if inet proto tcp  all keep state
pass out       on $ext_if inet proto udp  all keep state
pass out quick on $ext_if inet proto icmp all icmp-type { 3, 8, 12 } \
keep state
pass in  quick on $ext_if inet proto icmp all icmp-type { 0, 3, 4, 11, 12 }

pass in  quick on $ext_if inet proto icmp from $external_net to $ext_if icmp-type 8
pass out quick on $ext_if inet proto icmp from $ext_if to $external_net icmp-type 0

pass in on $int_if from $int_if:network to any keep state

Как видно из правил нет не одного правила разрешающего хождение через ppp_if и tun_if, но при этом соединившись с машиной по ppp или pppd клиент свободно выходит наружу.
С чем это может быть связано? Где ошибка?

• Пакетный фильтр pf, KBAKEP, 13:47 , 20-Мрт-04, (1)