VPN problem

[Daniel Hartmeier]

On Sat, Sep 10, 2011 at 10:42:53AM -0300, Mario Lobo wrote:

> Sep 10 10:27:16 lobos kernel: pf_map_addr: selected address 177.17.68.103 
> Sep 10 10:27:49 lobos last message repeated 83 times
> Sep 10 10:28:59 lobos last message repeated 283 times

This looks as if you're not allowing the packet out after NAT, so
each subsequent packet also causes a pf_map_addr() call, instead
of creating a state entry.

Make sure you have a rule like

  pass out on $ext_if from ($ext_if) ...

Do you see any state entry related to your VPN connection?
Run pfctl -vvss after the connection attempt.

It helps debugging if you add

  block log

as the very first rule, then make sure all other block rules (if any)
also have 'log'. Then reproduce the problem while running

  tcpdump -s 1600 -nvvveeetttpi pflog0

Now you'll see any packet being dropped by pf. Do you see any?

Daniel