Исходное сообщение
"pf gif ipsec. Или лыжи не едут или я ничего не понимаю" Отправлено Kvantos, 27-Мрт-07 02:12
>>---cut >>pass out log on gif0 from 10.240.81.142 to any >>pass in log on gif0 from any to 10.240.81.142 >>---cut >Возможно пакеты не попадают в эти правила. >Попробуйте добавить опцию quick, или показывайте правила целиком. Это ПОЛНЫЙ pf.conf для zeus set block-policy drop set skip on {lo0 rl0 xl0 rl1 pfsync0} # Отлавливается pass out log on gif0 from any to any # Не отлавливается pass in log on gif0 from any to any Имеем zeus# tcpdump -i pflog0 host 10.240.81.47 tcpdump: WARNING: pflog0: no IPv4 address assigned tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on pflog0, link-type PFLOG (OpenBSD pflog file), capture size 96 bytes 01:03:42.072060 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 41992, length 40 01:03:43.091039 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 42248, length 40 01:03:44.116168 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 42504, length 40 01:03:45.123596 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 42760, length 40 01:03:46.138983 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 43016, length 40 01:03:47.151451 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 43272, length 40 01:03:48.166094 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 43528, length 40 zeus# tcpdump -i gif0 host 10.240.81.47 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on gif0, link-type NULL (BSD loopback), capture size 96 bytes 01:04:47.972196 IP 10.240.81.47 > ya.ru: ICMP echo request, id 512, seq 58632, length 40 01:04:48.098186 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 58632, length 40 01:04:48.998565 IP 10.240.81.47 > ya.ru: ICMP echo request, id 512, seq 58888, length 40 01:04:49.126072 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 58888, length 40 01:04:49.993366 IP 10.240.81.47 > ya.ru: ICMP echo request, id 512, seq 59144, length 40 01:04:50.118500 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 59144, length 40 01:04:51.009889 IP 10.240.81.47 > ya.ru: ICMP echo request, id 512, seq 59400, length 40 01:04:51.136739 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 59400, length 40 это на противоположном конце тунеля astra#  tcpdump -i gif0 host 10.240.81.47 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on gif0, link-type NULL (BSD loopback), capture size 96 bytes 19:02:54.323254 IP 10.240.81.47 > ya.ru: ICMP echo request, id 512, seq 23048, length 40 19:02:54.453409 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 23048, length 40 19:02:55.341032 IP 10.240.81.47 > ya.ru: ICMP echo request, id 512, seq 23304, length 40 19:02:55.469907 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 23304, length 40 19:02:56.352879 IP 10.240.81.47 > ya.ru: ICMP echo request, id 512, seq 23560, length 40 19:02:56.482053 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 23560, length 40 19:02:57.370297 IP 10.240.81.47 > ya.ru: ICMP echo request, id 512, seq 23816, length 40 19:02:57.499830 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 23816, length 40 19:02:58.384618 IP 10.240.81.47 > ya.ru: ICMP echo request, id 512, seq 24072, length 40 19:02:58.516015 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 24072, length 40 P.S. 10.240.81.47 идет через шлюз astra по тунелю на zeus Ребята помогайте сил уже нету !!! :(