Добрый день.

Не удается пробросить порт 3389 внутрь сети
Шлюз FreeBSD 6.3, pf

192.168.0.0/24 - локальная сеть
192.168.3.5 - внешний ифейс смотрит на адсл-роутер (настроен роутером, если напрямую втыкать - работает)
На клиенте интернет есть, шлюзом сервер 192.168.0.5

Другие порты (по крайней мере 80 23) фурычат. Со шлюза машины в лок.сети видны, телнетом можно приконектиться

ipfw/natd в таких же условиях работает

pf.conf
в данном конфиге 80 порт работает
##############################################
# MACROS
ext_if = "em1"
int_if = "em0"
ext_addr = "192.168.3.5"
int_addr = "192.168.0.5"
int_net = "192.168.0.0/24"

set optimization normal
set block-policy drop
set loginterface $ext_if
set fingerprints "/etc/pf.os"

scrub in on ! lo0 all fragment reassemble

# NAT
nat on $ext_if from 192.168.0.7 to any -> ($ext_if)
nat on $ext_if from 192.168.0.15 to any -> ($ext_if)

# RDR
rdr on $ext_if proto tcp from any to any port 8080 -> 192.168.0.7 port 80
rdr on $ext_if proto tcp from any to any port 3389 -> 192.168.0.15 port 3389

# RULES
block log all

pass quick on lo0 all

# block ip
block in quick log on $ext_if from 81.9.67.150 to any

# nmap
block in quick from any os NMAP

# spoofing
antispoof log quick for $ext_if
block drop in  quick on $ext_if from <private_nets> to any
block drop out quick on $ext_if from any to <private_nets>

pass out on $ext_if proto tcp from $ext_addr to any flags S/SA keep state
pass out on $ext_if proto udp from $ext_addr to any keep state
pass out on $ext_if proto icmp from $ext_addr to any icmp-type $icmp_types keep state

# icmp
block in inet proto icmp from $int_if:network
pass out inet proto icmp from $int_addr to any icmp-type $icmp_types keep state
pass in inet proto icmp from <users> to $int_addr icmp-type $icmp_types keep state
pass in inet proto icmp from <users> to any icmp-type $icmp_types keep state

# traceroute
pass out on $ext_if inet proto udp from any to any port 33433 >< 33626 keep state

# 80
pass proto tcp from $admin to $nas1_server_addr port 80 keep state
# rdp
pass proto tcp from $admin to 192.168.0.15 port 3389 keep state
##############################################

pfctl -ss | grep 3389
##############################################
self tcp internet:52391 -> 192.168.0.15:3389       SYN_SENT:CLOSED
self tcp 192.168.0.15:3389 <- 192.168.3.5:3389 <- internet:52391       CLOSED:SYN_SENT
##############################################

tcpdump -n -e -ttt -i pflog0
##############################################
тишина
##############################################

Спасибо