You have to change from: pass out on $ext_if proto tcp from <LH> to <Ext> port ssh flags S/SAFR modulate state queue(std_out, iac_out) pass out on $ext_if proto tcp from <LH> to <Ext> port $iac_ports flags S/SAFR modulate state queue(iac_out, ack_out)
to: pass in on $ext_if proto tcp from <LH> to <Ext> port ssh flags S/SAFR modulate state queue(std_out, iac_out) pass in on $ext_if proto tcp from <LH> to <Ext> port $iac_ports flags S/SAFR modulate state queue(iac_out, ack_out) Since you are tracking state with S/SAFR that rule can keep track only of connetion initiated by $gateway itself. If you use in it will track the connection generated by outside peers. Don't confuse the concept that ALTQ shapes only outgoing connections with the keep state one. Hopes it helps. _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-pf To unsubscribe, send any mail to "[EMAIL PROTECTED]"
