🚀 go-pugleaf

Witam,

Po padzie dysku postawilem serwer na FBSD7.2 (wczesniej byl na FBSD5.x). 
Z backupu odtworzylem konfiguracje, ale po wrzuceniu konfiga dla pf 
zaczely sie problemy. Konfig ktory wczesniej dzialal znakomicie teraz 
kolejkuje tylko w jedna strone. Upload dziala dobrze, natomiast download 
wrzuca wszystko do kolejki default. Walcze z tym od tygodnia, 
przeszukalem juz mase stron w necie i ciagle nie moge wpasc na 
rozwiazanie. Nawet znalazlem opis podobnego problemu, ale rozwiazania 
nie bylo. Jakby ktos mogl zerknac na ponizszy konfig i pomoc to bede 
wdzieczny.

Pozdrawiam,
Bobi

# Macros: define common values, so they can be referenced and changed 
easily.
ext_if="xl1"    # replace with actual external interface name i.e., dc0
int_if="xl0"    # replace with actual internal interface name i.e., dc1
internal_net="192.168.1.0/28"
external_addr="xxx.xxx.xxx.xxx"
ip_klient1="192.168.1.2"
ip_klient2="192.168.1.3"
ip_klient3="192.168.1.4"

porty="{ 199, 22 }"
priv_nets = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }"

# Normalization: reassemble fragments and resolve or reduce traffic 
ambiguities.
scrub in all

# Kolejkowanie int>lan
altq on $int_if hfsc bandwidth 1000Kb queue { def_int, klient1_int, 
klient2_int, klient3_int }
   queue def_int hfsc (default realtime 256Kb linkshare 25%)
   queue klient1_int hfsc (realtime 256Kb linkshare 25% upperlimit 512Kb)
   queue klient2_int hfsc (realtime 256Kb linkshare 25% upperlimit 512Kb)
   queue klient3_int hfsc (realtime 256Kb linkshare 25% upperlimit 512Kb)

# lan>int
altq on $ext_if hfsc bandwidth 256Kb queue { def_ext, klient1_ext, 
klient2_ext, klient3_ext }
   queue def_ext hfsc (default realtime 256Kb linkshare 25%)
   queue klient1_ext hfsc (realtime 256Kb linkshare 25% upperlimit 128Kb)
   queue klient2_ext hfsc (realtime 256Kb linkshare 25% upperlimit 128Kb)
   queue klient3_ext hfsc (realtime 256Kb linkshare 25% upperlimit 128Kb)

# NAT i Tagowanie
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
nat on $ext_if from $ip_klient1 to any tag KLIENT1 -> ($ext_if)
nat on $ext_if from $ip_klient2 to any tag KLIENT2 -> ($ext_if)
nat on $ext_if from $ip_klient3 to any tag KLIENT3 -> ($ext_if)

# RDR
rdr on $int_if proto tcp from any to any port ftp -> 127.0.0.1 port 8021
anchor "ftp-proxy/*"

# Firewall
# Loopback
pass quick on lo0 all
pass out quick on $ext_if proto icmp from any to any keep state
pass in on $ext_if proto tcp from any to any port 21 keep state
pass in on $ext_if proto tcp from any to any port > 49151 keep state

# INT_IF
block out on $int_if all
pass in on $int_if all

# EXT_IF
block out on $ext_if all
block in on $ext_if all

# Tagowanie i Filtrowanie
antispoof quick for $int_if inet
block drop in  quick on $ext_if from $priv_nets to any
block drop out quick on $ext_if from any to $priv_nets

# Blokujemy uslugi z zewnatrz na serwer
pass in quick on $ext_if inet proto { tcp, udp } from $internal_net to 
$ext_if
block in quick on $ext_if inet proto { tcp, udp } from any to $ext_if 
port $porty

# Zezwalamy pakietom na wchodzenie do naszej sieci
pass in on $ext_if proto { tcp udp } from any to any
pass out on $int_if from any to $ip_klient1 queue klient1_int
pass out on $int_if from any to $ip_klient2 queue klient2_int
pass out on $int_if from any to $ip_klient3 queue klient3_int
#################################################################
pass out quick on $ext_if tagged KLIENT1 keep state (max 250) queue 
klient1_ext
pass out quick on $ext_if tagged KLIENT2 keep state (max 250) queue 
klient2_ext
pass out quick on $ext_if tagged KLIENT3 keep state (max 250) queue 
klient3_ext
pass out on $ext_if from any to any queue def_ext
##################################################################