FreeBSD gate.vtg 8.1-RELEASE FreeBSD 8.1-RELEASE #2: Mon Jan 2 14:19:17 EET 2012 strait@gate.vtg:/usr/src/sys/amd64/compile/vtg amd64cat /etc/sysctl.conf:
net.inet.icmp.drop_redirect=1
net.inet.tcp.drop_synfin=1
net.bpf.maxbufsize=16777216
net.bpf.bufsize=4194304
kern.ipc.nmbclusters=131072
kern.ipc.maxsockbuf=2097152
net.inet.udp.recvspace=1048576
net.inet.udp.maxdgram=131072
net.local.dgram.recvspace=1048576
net.local.dgram.maxdgram=131072
net.inet.tcp.sendspace=131072
net.inet.tcp.recvspace=131072
net.inet.tcp.msl=7500
net.inet.tcp.nolocaltimewait=1
cat /etc/pf.conf
ext_wnet="igb1"
wnet_gw="..."
ext_dg="igb0"
dg_gw="..."
int="bce0"
#set state-policy if-bound
set skip on lo0
#scrub on $ext_wnet all no-df random-id min-ttl 15
#scrub on $ext_dg all no-df random-id min-ttl 15
table <natusers> {192.168.30.0/24, 192.168.2.61, 192.168.32.24, 192.168.1.15, 192.168.2.175, 10.0.20.2, 10.0.21.10, 10.0.21.16/29}
table <buhi> {192.168.2.56, 192.168.2.57, 192.168.2.59, 192.168.2.105}
nat on $ext_wnet from <natusers> to {mail.ukrpost.ua, mail.i.com.ua} -> ($ext_wnet)
nat on $ext_dg from <natusers> to {mail.ukrpost.ua, mail.i.com.ua} -> ($ext_dg)
nat on $ext_wnet from <natusers> to any port != smtp -> ($ext_wnet)
nat on $ext_dg from <natusers> to any port != smtp -> ($ext_dg)
nat on $ext_wnet from 192.168.2.1 to any port https -> ($ext_wnet)
nat on $ext_dg from 192.168.2.1 to any port https -> ($ext_dg)
rdr on {$ext_wnet, $ext_dg} proto tcp from any to {$ext_wnet, $ext_dg} port rdp -> 192.168.1.10
rdr on {$ext_wnet, $ext_dg} proto tcp from any to {$ext_wnet, $ext_dg} port 5650 -> 192.168.30.93
rdr on {$ext_wnet, $ext_dg} proto tcp from any to {$ext_wnet, $ext_dg} port 5938 -> 192.168.30.32
nat on $ext_wnet from any to ungg.org -> ($ext_wnet)
nat on $ext_wnet from 192.168.2.105 to 195.248.93.152 port 5557 -> ($ext_wnet)
nat on $ext_dg from 192.168.2.105 to 195.248.93.152 port 5557 -> ($ext_dg)
nat on $ext_wnet from <buhi> to {ibank.alfabank.ru, ibank.aval.ua} port 443 -> ($ext_wnet)
nat on $ext_dg from <buhi> to {ibank.alfabank.ru, ibank.aval.ua} port 443 -> ($ext_dg)
#block in
#block out
pass on bce1 all
block in quick on bce1 from any to 192.168.0.0/16
pass on $int all
pass on tun0
pass all
# Incoming policy
pass in quick on $ext_wnet reply-to ($ext_wnet $wnet_gw) proto tcp to ($ext_wnet) port {smtp, 465, 587, domain, www, imaps} keep state
pass in quick on $ext_dg reply-to ($ext_dg $dg_gw) proto tcp to ($ext_dg) port {smtp, 465, 587, domain, www, imaps} keep state
pass in quick on $ext_wnet reply-to ($ext_wnet $wnet_gw) proto udp to ($ext_wnet) port {domain, 1194} keep state
pass in quick on $ext_dg reply-to ($ext_dg $dg_gw) proto udp to ($ext_dg) port {domain, 1194} keep state
pass in quick on $ext_wnet reply-to ($ext_wnet $wnet_gw) proto tcp to ($ext_wnet) port ssh keep state (source-track rule, max-src-states 1)
pass in quick on $ext_dg reply-to ($ext_dg $dg_gw) proto tcp to ($ext_dg) port ssh keep state (source-track rule, max-src-states 1)
pfctl -sm:
states hard limit 10000
src-nodes hard limit 10000
frags hard limit 5000
tables hard limit 1000
table-entries hard limit 100000
netstat -m
66564/2301/68865 mbufs in use (current/cache/total)
33789/2041/35830/131072 mbuf clusters in use (current/cache/total/max)
33788/1284 mbuf+clusters out of packet secondary zone in use (current/cache)
0/388/388/12800 4k (page size) jumbo clusters in use (current/cache/total/max)
0/0/0/6400 9k jumbo clusters in use (current/cache/total/max)
0/0/0/3200 16k jumbo clusters in use (current/cache/total/max)
84219K/6209K/90428K bytes allocated to network (current/cache/total)
0/0/0 requests for mbufs denied (mbufs/clusters/mbuf+clusters)
0/0/0 requests for jumbo clusters denied (4k/9k/16k)
0/0/0 sfbufs in use (current/peak/max)
0 requests for sfbufs denied
0 requests for sfbufs delayed
0 requests for I/O initiated by sendfile
0 calls to protocol drain routines
и за компанию vmstat -i:
interrupt total rate
irq16: atapci0 1532649 9
irq17: uhci0 uhci2+ 120232 0
irq18: uhci1 uhci3 14 0
irq32: mfi0 1532624 9
cpu0: timer 319871711 2000
irq256: igb0 64192 0
irq257: igb0 21584 0
irq258: igb0 27571 0
irq259: igb0 22546 0
irq260: igb0 2 0
irq261: igb1 4149936 25
irq262: igb1 1845840 11
irq263: igb1 1993762 12
irq264: igb1 1864373 11
irq265: igb1 2 0
irq266: bce0 10844444 67
irq267: bce1 1 0
cpu1: timer 319871634 2000
cpu3: timer 319871635 2000
cpu2: timer 319871635 2000
Total 1303506387 8150
судя по последнему выводу с прерываниями все норм
Вариант для распечатки
(ok) on 06-Янв-12, 13:55 
