> Эх! Ну дайте вывод полный тех команд, что просили выше! Как помочь,
> если нужной информации нет?

Сократил пока так pf.conf
# Interfaces
int_if = "rl0"
ext_if = "fxp0"

# IP Address
lan_DMZ = "10.0.1.0/24"
int_ip = "10.0.1.241/32"
ext_ip = "87.87.86.210/30"
ext_ip_SERV1 = "87.87.87.193/32"
ext_ip_GATE = "87.87.87.209/16"
SERV1 = "10.0.1.7/32"
vlan21 = "vlan21"
arenda = "{ vlan6 vlan7 vlan12 vlan20 }"

# Ports
icmp_types = "{ echoreq, unreach }"

# СЕКЦИЯ  глобальные опции
set block-policy return
set state-policy floating
set skip on lo0
set limit { frags 100000, states 100000 }
set optimization normal

# СЕКЦИЯ параметры нормализации
scrub in all

# NAT & RDR

# SERV1
rdr on $ext_if proto {tcp, udp} from any to $ext_ip_SERV1 port 7777 -> $SERV1 port 7777
rdr on $vlan21 proto {tcp, udp} from any to $ext_ip_SERV1 port 7777 -> $SERV1 port 7777
rdr on $int_if proto {tcp, udp} from any to $ext_ip_SERV1 port 7777 -> $SERV1 port 7777
nat on $ext_if from $SERV1 to any -> $ext_ip_SERV1

# NAT dmz, vlan's
nat on $ext_if from $lan_DMZ to any -> $ext_ip
nat on $ext_if from $arenda to any -> $ext_ip

# Filter
antispoof quick for { lo0, $int_if, $ext_if }

block all

pass in on $int_if all
pass out on $int_if all

# Разрешаем доступ из интернета к серверам
pass in on $ext_if proto { tcp, udp } from any to $SERV1 port 7777
pass inet proto icmp all icmp-type $icmp_types keep state
pass in on $ext_if proto {tcp, udp} from any to any port 53
pass out on $ext_if all

pass in on $arenda all
pass out on $arenda all

pass in on $vlan21 from $ext_ip_GATE
pass out on $vlan21

# ifconfig
rl0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=8<VLAN_MTU>
        ether 00:80:48:34:a1:26
        inet 10.0.1.241 netmask 0xffffff00 broadcast 10.0.1.255
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
fxp0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=2009<RXCSUM,VLAN_MTU,WOL_MAGIC>
        ether 00:07:e9:b6:9c:a5
        inet 87.87.86.210 netmask 0xfffffffc broadcast 87.87.86.211
        inet 87.87.87.193 netmask 0xffffffff broadcast 87.87.87.193
        media: Ethernet 100baseTX <full-duplex>
        status: active
plip0: flags=8810<POINTOPOINT,SIMPLEX,MULTICAST> metric 0 mtu 1500
pfsync0: flags=0<> metric 0 mtu 1460
        syncpeer: 224.0.0.240 maxupd: 128
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
        options=3<RXCSUM,TXCSUM>
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x5
        inet6 ::1 prefixlen 128
        inet 127.0.0.1 netmask 0xff000000
pflog0: flags=0<> metric 0 mtu 33200
vlan1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether 00:80:48:34:a1:26
        inet 10.0.0.241 netmask 0xffffff00 broadcast 10.0.0.255
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
        vlan: 1 parent interface: rl0
vlan3: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether 00:80:48:34:a1:26
        inet 10.0.2.1 netmask 0xffffff00 broadcast 10.0.2.255
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
        vlan: 3 parent interface: rl0
vlan5: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether 00:80:48:34:a1:26
        inet 10.0.5.1 netmask 0xffffff00 broadcast 10.0.5.255
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
        vlan: 5 parent interface: rl0
vlan6: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether 00:80:48:34:a1:26
        inet 10.0.6.1 netmask 0xffffff00 broadcast 10.0.6.255
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
        vlan: 6 parent interface: rl0
vlan7: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether 00:80:48:34:a1:26
        inet 10.0.7.1 netmask 0xffffff00 broadcast 10.0.7.255
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
        vlan: 7 parent interface: rl0
vlan12: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether 00:80:48:34:a1:26
        inet 10.0.3.1 netmask 0xffffff00 broadcast 10.0.3.255
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
        vlan: 12 parent interface: rl0
vlan20: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether 00:80:48:34:a1:26
        inet 10.0.11.1 netmask 0xffffff00 broadcast 10.0.11.255
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
        vlan: 20 parent interface: rl0
vlan21: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether 00:80:48:34:a1:26
        inet 87.87.87.209 netmask 0xfffffff0 broadcast 87.87.87.223
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
        vlan: 21 parent interface: rl0

# netstat -nr
Routing tables

Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
default            87.87.86.209       UGS        67      502   fxp0
10.0.0.0/24        link#7             U           0        0  vlan1
10.0.0.241         link#7             UHS         0        0    lo0
10.0.1.0/24        link#1             U           0        0    rl0
10.0.1.241         link#1             UHS         0        0    lo0
10.0.2.0/24        link#8             U           0        0  vlan3
10.0.2.1           link#8             UHS         0        0    lo0
10.0.3.0/24        link#12            U           0        0 vlan12
10.0.3.1           link#12            UHS         0        0    lo0
10.0.5.0/24        link#9             U           0        0  vlan5
10.0.5.1           link#9             UHS         0        0    lo0
10.0.6.0/24        link#10            U           0        0  vlan6
10.0.6.1           link#10            UHS         0        0    lo0
10.0.7.0/24        link#11            U           0        0  vlan7
10.0.7.1           link#11            UHS         0        0    lo0
10.0.11.0/24       link#13            U           0        0 vlan20
10.0.11.1          link#13            UHS         0        0    lo0
87.87.87.87        link#2             UHS         0        0    lo0 =>
87.87.87.87/32     link#2             U           0        0   fxp0
87.87.87.208/28    link#14            U           0       84 vlan21
87.87.87.209       link#14            UHS         0        0    lo0
87.87.86.208/30    link#2             U           0        0   fxp0
87.87.86.210       link#2             UHS         0        0    lo0
127.0.0.1          link#5             UH          0      783    lo0

Internet6:
Destination                       Gateway                       Flags      Netif Expire
::1                               ::1                           UH          lo0
fe80::%lo0/64                     link#5                        U           lo0
fe80::1%lo0                       link#5                        UHS         lo0
ff01:5::/32                       fe80::1%lo0                   U           lo0
ff02::%lo0/32                     fe80::1%lo0                   U           lo0

Обозначения:
87.87.86.209 - шлюз провайдера
87.87.86.210 - внешний ИП моего шлюза
87.87.87.193 - внешний ИП SERV1
87.87.87.209 - мой шлюз (vlan21)

# pfctl -sr
scrub in all fragment reassemble
block drop in quick on ! lo0 inet6 from  ::1 to any
block drop in quick on ! lo0 inet from 127.0.0.1/8 to any
block drop in quick on ! rl0 inet6 from 10.0.1.0/24 to any
block drop in quick inet from 10.0.1.241 to any
block drop in quick on ! fxp0 inet from 87.87.87.208/30 to any
block drop in quick on ! fxp0 inet from 87.87.86.193 to any
block drop in quick inet from 87.87.86.210 to any
block drop in quick inet from 87.87.87.193 to any
block return all
pass in on rl0 all flags S/SA keep state
pass out on rl0 all flags S/SA keep state
pass in on fxp0 inet proto tcp from any to  10.0.1.7 port = 7777 flags S/SA keep state
pass inet proto icmp all icmp-type echoreq keep state
pass inet proto icmp all icmp-type unreach keep state
pass in on fxp0 inet proto tcp from any to any port = domain flags S/SA keep state
pass in on fxp0 inet proto udp from any to any port = domain keep state
pass out on fxp0 all flags S/SA keep state
pass in on vlan6 all flags S/SA keep state
pass in on vlan7 all flags S/SA keep state
pass in on vlan12 all flags S/SA keep state
pass in on vlan20 all flags S/SA keep state
pass out on vlan6 all flags S/SA keep state
pass out on vlan7 all flags S/SA keep state
pass out on vlan12 all flags S/SA keep state
pass out on vlan20 all flags S/SA keep state
pass in on vlan21 inet from 87.87.87.208/29 to any flags S/SA keep state
pass out on vlan21 all flags S/SA keep state

87.87.87.209 - мой шлюз (vlan21)
имеется ввиду для других подсетей

Подскажите, почему после запуска PF блокируется трафик как в интернет, так и в локальную сеть?

>> Подскажите, почему после запуска PF блокируется трафик как в интернет, так и
>> в локальную сеть?
> показывайте настройки сети и текущие правила после запуска PF, выше вы показываете
> в pf.conf одни правила , а текущие совсем другие

Вот pf.conf
# Interfaces
int_if = "rl0"
ext_if = "fxp0"

# IP Address
lan_DMZ = "10.0.1.0/24"
int_ip = "10.0.1.241/32"
ext_ip = "87.87.86.210/30"
ext_ip_SERV1 = "87.87.87.193/32"
ext_ip_GATE = "87.87.87.209/16"
SERV1 = "10.0.1.7/32"
vlan21 = "vlan21"
arenda = "{ vlan6 vlan7 vlan12 vlan20 }"

# Ports
icmp_types = "{ echoreq, unreach }"

# СЕКЦИЯ  глобальные опции
set block-policy return
set state-policy floating
set skip on lo0
set limit { frags 100000, states 100000 }
set optimization normal

# СЕКЦИЯ параметры нормализации
scrub in all

# NAT & RDR

# SERV1
rdr on $ext_if proto {tcp, udp} from any to $ext_ip_SERV1 port 7777 -> $SERV1 port 7777
rdr on $vlan21 proto {tcp, udp} from any to $ext_ip_SERV1 port 7777 -> $SERV1 port 7777
rdr on $int_if proto {tcp, udp} from any to $ext_ip_SERV1 port 7777 -> $SERV1 port 7777
nat on $ext_if from $SERV1 to any -> $ext_ip_SERV1

# NAT dmz, vlan's
nat on $ext_if from $lan_DMZ to any -> $ext_ip
nat on $ext_if from $arenda to any -> $ext_ip

# Filter
antispoof quick for { lo0, $int_if, $ext_if }

block all

pass in on $int_if all
pass out on $int_if all

# Разрешаем доступ из интернета к серверам
pass in on $ext_if proto { tcp, udp } from any to $SERV1 port 7777
pass inet proto icmp all icmp-type $icmp_types keep state
pass in on $ext_if proto {tcp, udp} from any to any port 53
pass out on $ext_if all

pass in on $arenda all
pass out on $arenda all

pass in on $vlan21 from $ext_ip_GATE
pass out on $vlan21

# pfctl -sr
scrub in all fragment reassemble
block drop in quick on ! lo0 inet6 from  ::1 to any
block drop in quick on ! lo0 inet from 127.0.0.1/8 to any
block drop in quick on ! rl0 inet6 from 10.0.1.0/24 to any
block drop in quick inet from 10.0.1.241 to any
block drop in quick on ! fxp0 inet from 87.87.87.208/30 to any
block drop in quick on ! fxp0 inet from 87.87.86.193 to any
block drop in quick inet from 87.87.86.210 to any
block drop in quick inet from 87.87.87.193 to any
block return all
pass in on rl0 all flags S/SA keep state
pass out on rl0 all flags S/SA keep state
pass in on fxp0 inet proto tcp from any to  10.0.1.7 port = 7777 flags S/SA keep state
pass inet proto icmp all icmp-type echoreq keep state
pass inet proto icmp all icmp-type unreach keep state
pass in on fxp0 inet proto tcp from any to any port = domain flags S/SA keep state
pass in on fxp0 inet proto udp from any to any port = domain keep state
pass out on fxp0 all flags S/SA keep state
pass in on vlan6 all flags S/SA keep state
pass in on vlan7 all flags S/SA keep state
pass in on vlan12 all flags S/SA keep state
pass in on vlan20 all flags S/SA keep state
pass out on vlan6 all flags S/SA keep state
pass out on vlan7 all flags S/SA keep state
pass out on vlan12 all flags S/SA keep state
pass out on vlan20 all flags S/SA keep state
pass in on vlan21 inet from 87.87.87.208/29 to any flags S/SA keep state
pass out on vlan21 all flags S/SA keep state

вот так. Пробовал убирать block all, но ситуация не изменилась.

>>>> Подскажите, почему после запуска PF блокируется трафик как в интернет, так и
>>>> в локальную сеть?
>>> показывайте настройки сети и текущие правила после запуска PF, выше вы показываете
>>> в pf.conf одни правила , а текущие совсем другие
> вы хотите сказать что из этого pf.conf получили правила которые показали по
> pfctl -sr ниже?

Да. Я сам не понимаю откуда берутся block

Даже если написать вместо block all -> pass all
и перезапустить #pfctl -F all -f /etc/pf.conf то все равно все блокируется.

>ext_ip = "87.87.86.210"

написал так

ext_ip_GATE = "87.87.87.209/16" а у вас from 87.87.87.208/29
на это пока можно не обращать внимание

Мне главное пока, чтобы шли пинги в инет и в DMZ.

>[оверквотинг удален]
>> написал так
>> ext_ip_GATE = "87.87.87.209/16" а у вас from 87.87.87.208/29
>> на это пока можно не обращать внимание
>> Мне главное пока, чтобы шли пинги в инет и в DMZ.
> значит стирайте абсолютно все из pf.conf включая set *, antispoof - все
> стираете.
> пишите правило nat для локалки и pass all и проверяете что это
> заработало, потом добавляете ОДНО правило проброса и заставляете проброс заработать, потом
> добавляете еще одно правило в pf.conf и проверяете , что оно
> отрабатывает и т.д.

pf.conf
# Interfaces
int_if = "rl0"
ext_if = "fxp0"

# IP Address
lan_DMZ = "10.0.1.0/24"
int_ip = "10.0.1.241/32"
ext_ip = "87.87.86.210"

nat on $ext_if from $lan_DMZ to any -> $ext_ip
pass all

#pfctl -sr
pass all flags S/SA keep state

Но пинги опять никуда не идут.

Я сделал новый сервер в качестве шлюза.
PF в минимальной конфигурации запустился.

# Interfaces
int_if = "rl0"
ext_if = "fxp0"

# IP
ext_ip_SERV1 = "87.87.87.193/32"
SERV1 = "10.0.1.7/32"
serv1_ports = "{ 1122, 1133 }"

# NAT RDR
rdr on $ext_if proto udp from any to $ext_ip_SERV1 port $serv1_ports -> $SERV1 port $serv1_ports
nat on $ext_if from $SERV1 to any -> $ext_ip_SERV1

Подскажите, возможно ли использовать такую конструкцию для проброса портов?

Спасибо.
Еще один вопрос.
Созданы vlan на внутреннем интерфейсе в rc.conf
cloned_interfaces="vlan1 vlan3 vlan5 vlan12 vlan13 vlan20 vlan21"

ifconfig_vlan3="inet 10.0.2.1 netmask 255.255.255.0 vlan 3 vlandev rl0"

нужно натить этот vlan в инет. В PF прописано:

# Interfaces
int_if = "rl0"
ext_if = "fxp0"

# IP Address
lan_DMZ = "10.0.1.0/24"
int_ip = "10.0.1.241/32"
ext_ip = "87.87.86.210/32"
vlan3 = "vlan3"

block all

nat on $ext_if from $lan_DMZ to any -> $ext_ip
nat on $ext_if from $vlan3 to any -> $ext_ip

pass in quick on $vlan3 all
pass out quick on $vlan3 all

pass in on $int_if all
pass out on $int_if all

pass inet proto icmp all icmp-type $icmp_types keep state
pass in on $ext_if proto {tcp, udp} from any to any port 53
pass out on $ext_if all

Инета нет в этом vlan. Свой шлюз 10.0.2.1 пингуется.
ping ya.ru - ИП адрес ya.ru определяет, но пинг не идет:
Заданный узел недоступен.

Подскажите, пожалуйста, что не так?