>>---cut
>>pass out log on gif0 from 10.240.81.142 to any
>>pass in log on gif0 from any to 10.240.81.142
>>---cut
>Возможно пакеты не попадают в эти правила.
>Попробуйте добавить опцию quick, или показывайте правила целиком.

Это ПОЛНЫЙ pf.conf для zeus

set block-policy drop
set skip on {lo0 rl0 xl0 rl1 pfsync0}
# Отлавливается
pass out log on gif0 from any to any
# Не отлавливается
pass in log on gif0 from any to any

Имеем

zeus# tcpdump -i pflog0 host 10.240.81.47
tcpdump: WARNING: pflog0: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on pflog0, link-type PFLOG (OpenBSD pflog file), capture size 96 bytes
01:03:42.072060 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 41992, length 40
01:03:43.091039 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 42248, length 40
01:03:44.116168 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 42504, length 40
01:03:45.123596 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 42760, length 40
01:03:46.138983 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 43016, length 40
01:03:47.151451 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 43272, length 40
01:03:48.166094 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 43528, length 40

zeus# tcpdump -i gif0 host 10.240.81.47
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on gif0, link-type NULL (BSD loopback), capture size 96 bytes
01:04:47.972196 IP 10.240.81.47 > ya.ru: ICMP echo request, id 512, seq 58632, length 40
01:04:48.098186 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 58632, length 40
01:04:48.998565 IP 10.240.81.47 > ya.ru: ICMP echo request, id 512, seq 58888, length 40
01:04:49.126072 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 58888, length 40
01:04:49.993366 IP 10.240.81.47 > ya.ru: ICMP echo request, id 512, seq 59144, length 40
01:04:50.118500 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 59144, length 40
01:04:51.009889 IP 10.240.81.47 > ya.ru: ICMP echo request, id 512, seq 59400, length 40
01:04:51.136739 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 59400, length 40

это на противоположном конце тунеля
astra#  tcpdump -i gif0 host 10.240.81.47
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on gif0, link-type NULL (BSD loopback), capture size 96 bytes
19:02:54.323254 IP 10.240.81.47 > ya.ru: ICMP echo request, id 512, seq 23048, length 40
19:02:54.453409 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 23048, length 40
19:02:55.341032 IP 10.240.81.47 > ya.ru: ICMP echo request, id 512, seq 23304, length 40
19:02:55.469907 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 23304, length 40
19:02:56.352879 IP 10.240.81.47 > ya.ru: ICMP echo request, id 512, seq 23560, length 40
19:02:56.482053 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 23560, length 40
19:02:57.370297 IP 10.240.81.47 > ya.ru: ICMP echo request, id 512, seq 23816, length 40
19:02:57.499830 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 23816, length 40
19:02:58.384618 IP 10.240.81.47 > ya.ru: ICMP echo request, id 512, seq 24072, length 40
19:02:58.516015 IP ya.ru > 10.240.81.47: ICMP echo reply, id 512, seq 24072, length 40

P.S. 10.240.81.47 идет через шлюз astra по тунелю на zeus

Ребята помогайте сил уже нету !!! :(