🚀 go-pugleaf

witam
dopadlem w necie taka konfiguracje na router

pf.conf

ip_gate =    "80.  ......"
ext_if =     "xl0"
flag1 =""
flag = "flags S/SA keep state (source-track global, max-src-states 100,
if-bound)"
int_if =     "xl1"
ports="{1><24,26><444,446><65535}"

prv_hosts =  "192.168.0.0/24"
unfiltered = "{lo0}"
icmp_types = "{ 0, 8, 15, 30 }"

dl =            "8192Kb"
ul =            "2240Kb"
noc_download = "1"
noc_upload   = "1"

set loginterface $ext_if
set loginterface $int_if

set optimization aggressive
set block-policy drop
set require-order yes
set limit frags 300000
scrub in all fragment reassemble
scrub out all fragment reassemble

#antispoof for $int_if
#antispoof for $ext_if
altq on $int_if hfsc bandwidth $dl queue { def \
_2 \
_3 \
_4 \
_5 \
_6 \
}

altq on $ext_if hfsc bandwidth $ul queue { defu \
_2u \
_3u \
_4u \
_5u \
_6u \
}
# Kolejki defaultowe:
queue def bandwidth 1% hfsc(default upperlimit 8192Kb)
queue defu bandwidth 1% hfsc(default upperlimit 630Kb)
 queue _2               bandwidth 1%  hfsc( upperlimit 850Kb )
 queue _2u              bandwidth 1%  hfsc( upperlimit 180Kb )
 queue _3               bandwidth 1%  hfsc( upperlimit 900Kb )
 queue _3u              bandwidth 1%  hfsc( upperlimit 185Kb )
 queue _4               bandwidth 1%  hfsc( upperlimit 800Kb )
 queue _4u              bandwidth 1%  hfsc( upperlimit 185Kb )
 queue _5               bandwidth 1%  hfsc( upperlimit 800Kb )
 queue _5u              bandwidth 1%  hfsc( upperlimit 185Kb )
 queue _6               bandwidth 1%  hfsc( upperlimit 800Kb )
 queue _6u              bandwidth 1%  hfsc( upperlimit 185Kb )




#pass in quick on $ext_if inet proto udp from any port 53 to any label
"DNS-in"
pass in quick on $int_if inet proto tcp from $prv_hosts to $int_if port 22
label "ssh-int"
pass in quick on $ext_if inet proto tcp from 0.0.0.0/0 to $ext_if port 22
label "ssh-ext"
pass in quick on $ext_if inet proto { tcp, udp } from 0.0.0.0/0 to $ext_if
port 161 label "snmp"
pass in quick on $ext_if inet proto tcp from 0.0.0.0/0 to $ext_if port 80
label "ipfm-www"
pass in quick inet proto icmp all icmp-type echoreq label "passed-icmp"
modulate state
pass out quick on $ext_if inet proto icmp from $ext_if to any keep state
icmp-type $icmp_types label "snmp"
block in quick on $ext_if inet proto tcp from any to any port
{1080,3128,4588,6588,445,3306,134 >< 140} label "ms-ds-ext"
block in quick on $ext_if inet proto udp from any to any port
{1080,3128,4588,6588,445,3306,134 >< 140} label "ms-ds-ext"
block in quick on $int_if inet proto tcp from any to any port
{1080,3128,4588,6588,445,3306,134 >< 140} label "ms-ds"
block in quick on $int_if inet proto udp from any to any port
{1080,3128,4588,6588,445,3306,134 >< 140} label "ms-ds"

pass quick on $unfiltered label "loopback"
block in quick on $ext_if inet from any to 255.255.255.255 label
"broadcast"
block in all label "blocked"

pass in quick on $int_if inet proto {tcp,udp} from 192.168.0.2 to any port
$ports $flag queue _2u  label _2u
pass out quick on $int_if from any to 192.168.0.2  $flag queue _2  label _2
pass in quick on $int_if inet proto {tcp,udp} from 192.168.0.3 to any port
$ports $flag queue _3u  label _3u
pass out quick on $int_if from any to 192.168.0.3  $flag queue _3  label _3
pass in quick on $int_if inet proto {tcp,udp} from 192.168.0.4 to any port
$ports $flag queue _4u  label _4u
pass out quick on $int_if from any to 192.168.0.4  $flag queue _4  label _4
pass in quick on $int_if inet proto {tcp,udp} from 192.168.0.5 to any port
$ports $flag queue _5u  label _5u
pass out quick on $int_if from any to 192.168.0.5  $flag queue _5  label _5
pass in quick on $int_if inet proto {tcp,udp} from 192.168.0.6 to any port
$ports $flag queue _6u  label _6u
pass out quick on $int_if from any to 192.168.0.6  $flag queue _6  label _6

block in quick on $int_if  from any to any
pass in quick on $int_if from any to any label default
pass out quick on $int_if from any to any label default-upload
pass out on $ext_if from ($ext_if) to any keep state

antispoof for $int_if
antispoof for $ext_if

-altq dodane i skopilowane do jadra
device          pf
device          pflog
device          pfsync

#ALTQ
options         ALTQ
options         ALTQ_CBQ
options         ALTQ_RED
options         ALTQ_RIO
options         ALTQ_HFSC
options         ALTQ_CDNR
options         ALTQ_PRIQ

#FIREWALL
options         IPFIREWALL
options         IPFIREWALL_VERBOSE
options         IPFIREWALL_FORWARD
options         IPFIREWALL_VERBOSE_LIMIT=100
options         IPFIREWALL_DEFAULT_TO_ACCEPT
#options         IPV6FIREWALL
#options         IPV6FIREWALL_VERBOSE
#options         IPV6FIREWALL_VERBOSE_LIMIT=100
#options         IPV6FIREWALL_DEFAULT_TO_ACCEPT
options         IPSTEALTH
options         IPFILTER
options         IPFILTER_LOG
options         IPDIVERT


wszystko niby dziala tylko nie tnie to podanych wartosci
moze podacie mi kilka uwag co jest zle