>Вопрос, фаер пропускает GRE пакеты? Ну конечно пропускает, я для эксперимента даже pfctl -d делал, так нихера не прошло...:-(
more /etc/pf.conf
ext_if="em1"
int_if="em0"
set skip on { lo }
scrub in
nat on $ext_if from !($ext_if) -> ($ext_if:0)
rdr pass on $ext_if proto tcp from any to ($ext_if) port { 25 } tag RDR -> 192.168.0.253
rdr pass on $ext_if proto tcp from any to ($ext_if) port { 110 } tag RDR -> 192.168.0.253
rdr pass on $ext_if proto tcp from any to ($ext_if) port { 143 } tag RDR -> 192.168.0.253
rdr pass on $ext_if proto tcp from any to ($ext_if) port { 80 } tag RDR -> 192.168.0.253
block log all
pass quick on lo all
pass quick proto { icmp esp gre ipencap } all
pass quick on { tun0 tun1 tun2 tun3 } all keep state tag VPN
pass on enc0 all tag VPN keep state
pass in quick on $ext_if proto tcp from any to ($ext_if) port { ssh 1723 } keep state
pass in quick on $ext_if proto udp from any to ($ext_if) port isakmp keep state
pass in quick on $ext_if proto tcp from any to ($ext_if) port smtp keep state
pass quick on $int_if from ($int_if:network) to ($int_if:network)
pass in on $int_if from ($int_if:network) to any keep state
pass out on $ext_if all keep state
pass all tagged VPN keep state
pass all tagged RDR keep state