Всем привет!

Имеется за опенком windows 2003 с поднятым VPN
требуется сделать проброс GRE и 1723
На релизе 4.3 такую штуку когда то настраивал,
а в 4.9 - ни чего не получается!
Можт что неуглядел?

# /etc/pf.conf
#=============
ext_if="rl0"
int_if="rl1"
tcp_services = "{ ssh, smtp, domain, www, https, ntp, ftp, 43, 113, 1723 }"
udp_services = "{ domain, ntp, ftp }"
icmp_types = "{ echoreq, unreach }"
SERV_VPN = "192.168.3.8/32"

set block-policy return
table <sshbf> persist
set skip on lo
match out on $ext_if from !($ext_if) nat-to ($ext_if)

# Enable GRE

match in on $ext_if proto tcp from any to ($ext_if) port 1723 rdr-to $SERV_VPN port 1723
match in on $ext_if proto GRE from any to ($ext_if) rdr-to $SERV_VPN

match out on $ext_if proto tcp from any to ($ext_if) port 1723 rdr-to $SERV_VPN port 1723
match out on $ext_if proto GRE from any to ($ext_if) rdr-to $SERV_VPN

#Enable ports for FTP Passive Mode
pass in on $ext_if proto tcp from any to any port > 49151 keep state

# Enable VPN

pass quick proto gre from any
pass in on $ext_if proto gre from any to any keep state
pass out on $ext_if proto gre from any to any keep state

pass in on $ext_if proto tcp from any to any port 1723 keep state
pass out on $ext_if proto tcp from any to any port 1723 keep state

block in log quick on $ext_if inet from <sshbf>
pass in log on $ext_if inet proto tcp to $ext_if port ssh keep state \
        (max-src-conn-rate 5/60, overload <sshbf> flush global)

block in
pass out keep state

antispoof quick for { lo $int_if }

pass in on $ext_if inet proto icmp to ($ext_if)
pass in on $ext_if inet proto tcp from any to ($ext_if) \
        port $tcp_services flags S/SA keep state
pass in on $ext_if inet proto udp from any to ($ext_if) \
        port $udp_services
pass in inet proto icmp all icmp-type $icmp_types keep state
pass in quick on $int_if

## Microsoft VPN
pass in log on $ext_if proto tcp from any to any port 1723 \
   rdr-to $SERV_VPN
pass in log on $ext_if proto udp from any to any port 500 \
   rdr-to $SERV_VPN

pass in log on $ext_if inet proto tcp from any to any port 443 keep state
pass in log on $ext_if proto gre from any to any keep state
pass in log on $int_if inet proto tcp from any to any port = 1723 flags S/SA keep state

pass out log inet proto gre all keep state
pass out log on $int_if proto tcp from any to $SERV_VPN port 1723
pass out log on $int_if proto udp from any to $SERV_VPN port 500

#/etc/sysctl.conf
#================
net.inet.ip.forwarding=1
net.inet.gre.allow=1
net.inet.gre.wccp=1
net.inet.mobileip.allow=1

# tcpdump -nettt -i pflog0
tcpdump: WARNING: snaplen raised from 116 to 160
tcpdump: listening on pflog0, link-type PFLOG
Aug 02 18:15:03.335465 rule 38/(match) pass in on rl0: 212.158.165.10.50144 > 192.168.3.8.1723: S 3676967566:3676967566(0) win 65535 <mss 1460,nop,wscale 3,nop,nop,timestamp 850105329 0,[|tcp]> (DF)
Aug 02 18:15:03.335522 rule 40/(match) pass out on rl1: 212.158.165.10.50144 > 192.168.3.8.1723: S 3676967566:3676967566(0) win 65535 <mss 1460,nop,wscale 3,nop,nop,timestamp 850105329 0,[|tcp]> (DF)

и на этом все!!!

куда хоть копать?
плз