Всем привет! Структура на сегодня Интернет->PF OpenBSD 6(gate)->dns W2012->пользователь
Проблема: Периодически с gate не проходит телнет 80 или 443 на определенный ip.(Если поделючиться на прямую проблемы нет.)
pf.conf:
# Interfaces
int_if = rl0 #Local Interface
ext_if = re0 # External Interface
vpn_if = tun0 # VPN Interface
# Networks
int_net = $int_if:network # Local Network
vpn_net = $vpn_if:network # VPN NET
# Services & Ports
services_ssh = 22
services_voip = "{5060,7070:7089}"
services_rdp = 3389
service_vpn = 1195
# Local Stations
local_sa = "sa.hq.domain.ru"
local_pes = "pes.hq.domain.ru"
local_si = "owl.hq.domain.ru"
local_isp = "isp.hq.domain.ru"
local_zabbix = "zabbix.hq.domain.ru"
vpn_gw = 10.50.0.5
#Remote Locations
remote_iptelefon = "158.15.23.63"
#VPN_clients
vpnclients = "10.50.0.0/24"
#VoIP Provider
#s/sa
udpstate = "keep state"
# Essential config
block in proto tcp from any to $ext_if port ssh
set skip on lo
set skip on $vpn_if
block return in on $int_if
block return in on $ext_if
pass out all
antispoof for {$int_if,$ext_if}
pass out on $ext_if inet from $int_net nat-to $ext_if
pass in quick inet proto icmp to self
pass in quick inet proto icmp from {$int_net}
pass in quick inet proto tcp from any to self port $services_ssh
pass in on $ext_if proto udp from any to ext_if port $service_vpn $udpstate
# Basic config
pass in inet from $int_net to any
# VoIP
pass in inet proto udp from $remote_iptelefon to $ext_if port $services_voip
# RDP Passthrough (TEMPORARY!)
pass in inet proto tcp from any to $ext_if port 33389 \
rdr-to $local_sa port $services_rdp
# pass in inet proto tcp from any to $ext_if port 34389 \
# rdr-to $local_pes port $services_rdp
pass in inet proto tcp from any to $ext_if port 35389 \
rdr-to $local_s port $services_rdp
pass in inet proto tcp from any to $ext_if port 22222 \
rdr-to $local_p port 22
pass in inet proto tcp from any to $ext_if port 1500 \
rdr-to $local_p port 1500
#vpn
pass in on $vpn_if from $vpnclients to any
pass in on $vpn_if inet proto {tcp,udp} from $vpn_gw to any flags S/SA modulate state
pass out on $int_if to $int_net received-on $vpn_if nat-to $int_if
pass in on $vpn_if from any to any
#VPN_TCP
pass out on $vpn_if inet proto { tcp, udp } from $int_net to any flags S/SA modulate state nat-to ($int_if) round-robin
На пользователе Телнет не проходит вообще.
