BSDPORTAL.RU

C:\Users\yumi.ZIET>ping 95.211.162.245

Обмен пакетами с 95.211.162.245 по с 32 байтами данных:
Ответ от 95.211.162.245: число байт=32 время=45мс TTL=56
Ответ от 95.211.162.245: число байт=32 время=45мс TTL=56
Ответ от 95.211.162.245: число байт=32 время=45мс TTL=56
Ответ от 95.211.162.245: число байт=32 время=45мс TTL=56

Статистика Ping для 95.211.162.245:
    Пакетов: отправлено = 4, получено = 4, потеряно = 0
    (0% потерь)
Приблизительное время приема-передачи в мс:
    Минимальное = 45мсек, Максимальное = 45 мсек, Среднее = 45 мсек

C:\Users\yumi.ZIET>ping 95.211.58.111

Обмен пакетами с 95.211.58.111 по с 32 байтами данных:
Превышен интервал ожидания для запроса.
Превышен интервал ожидания для запроса.
Превышен интервал ожидания для запроса.
Превышен интервал ожидания для запроса.

Статистика Ping для 95.211.58.111:
    Пакетов: отправлено = 4, получено = 0, потеряно = 4
    (100% потерь)

block drop in quick on ! fxp1 inet from 188.231.xxx.xxx/25 to any
block drop in quick inet from 188.231.xxx.xxx to any prio 0
block drop in quick on fxp1 inet6 from fe80::2d0:b7ff:fe16:8b6 to any prio 0
pass all flags S/SA
block drop in on fxp1 all
block drop in log quick on fxp1 inet from <__automatic_971e3ec4_0> to any
pass out on fxp1 from <vpn_users> to any flags S/SA nat-to (fxp1) round-robin
pass in on fxp0 inet proto tcp from (fxp0:network) to (fxp0) port = pptp flags S/SA
pass in on fxp0 inet proto gre from (fxp0:network) to (fxp0)
pass in on tun inet from <vpn_users> to ! (self) flags S/SA
pass out on fxp1 from any to <tim_ip> flags S/SA

# pfctl -t tim_ip -T show
   46.4.68.241
   46.105.99.126
   46.165.192.0/24
   80.237.0.0/16
   81.169.0.0/16
   87.230.0.0/16
   87.230.74.0/24
   89.185.96.0/24
   92.51.171.0/24
   95.211.0.0/16
  !95.211.162.245
   151.1.182.135
   178.77.120.0/24
   202.143.0.0/16
   216.108.0.0/16
   217.172.187.0/24

 # tcpdump -nnvvS -i tun0
tcpdump: listening on tun0, link-type LOOP
15:38:38.943835 172.16.16.45 > 95.211.162.245: icmp: echo request (id:0400 seq:256) (ttl 128, id 37496, len 60)
15:38:38.990006 95.211.162.245 > 172.16.16.45: icmp: echo reply (id:0400 seq:256) (ttl 56, id 28531, len 60)
15:38:39.946985 172.16.16.45 > 95.211.162.245: icmp: echo request (id:0400 seq:512) (ttl 128, id 37499, len 60)
15:38:39.991225 95.211.162.245 > 172.16.16.45: icmp: echo reply (id:0400 seq:512) (ttl 56, id 28532, len 60)

15:41:39.134132 172.16.16.45 > 95.211.58.111: icmp: echo request (id:0400 seq:768) (ttl 128, id 38293, len 60)
15:41:44.265362 172.16.16.45 > 95.211.58.111: icmp: echo request (id:0400 seq:1024) (ttl 128, id 38317, len 60)
15:41:49.765034 172.16.16.45 > 95.211.58.111: icmp: echo request (id:0400 seq:1280) (ttl 128, id 38339, len 60)

all icmp 95.211.162.245:8 <- 172.16.16.45:1024       0:0
   age 00:00:01, expires in 00:00:10, 2:2 pkts, 120:120 bytes, rule 9
   id: 51e504c000d337ef creatorid: d52ff8c4
all icmp 188.231.212.132:8352 (172.16.16.45:1024) -> 95.211.162.245:8       0:0
   age 00:00:01, expires in 00:00:10, 2:2 pkts, 120:120 bytes, rule 6

@6 pass out on fxp1 from <vpn_users:1> to any flags S/SA nat-to (fxp1:2) round-robin
@9 pass in on tun inet from <vpn_users:1> to ! (self:4) flags S/SA

 # pfctl -sn
pfctl: Unknown show modifier 'n'
usage: pfctl [-deghnqrvz] [-a anchor] [-D macro=value] [-F modifier]
        [-f file] [-i interface] [-K host | network]
        [-k host | network | label | id] [-L statefile] [-o level] [-p device]
        [-S statefile] [-s modifier [-R id]] [-t table -T command [address ...]]
        [-x level]

 # uname -rvs
OpenBSD 5.0 GENERIC#43

 # grep -v "^#" /etc/pf.conf
set limit states 200000
set limit src-nodes 200000
set limit frags 1000000
set limit tables 20000
set limit table-entries 40000000

set skip on lo

ext_if = "fxp1"
int_if = "fxp0"
vpn_grp = "tun"
non_route_nets_inet = "{ 127.0.0.0/8, 192.168.0.0/16,\
                        172.16.0.0/12,10.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24, 0.0.0.0/8, 240.0.0.0/4 }"
table <vpn_users> { 172.16.16.32/27 }
table <tim_ip> { !95.211.162.245, 46.4.68.241, 151.1.182.135, 46.105.99.126, 92.51.171.0/24, 46.165.192.0/24, 95.211.58.0/16,\
            89.185.96.0/24, 178.77.120.0/24, 202.143.0.0/16, 216.108.0.0/16, 217.172.187.0/24, 80.237.0.0/16\
            81.169.0.0/16, 87.230.0.0/16, 87.230.74.0/24 }

antispoof quick for $ext_if

block in on $ext_if
block drop in log quick on $ext_if from $non_route_nets_inet to any

pass out on $ext_if from <vpn_users> nat-to ($ext_if)
block in on $vpn_grp to <tim_ip>