try to config PF + finckin PPTP passthrough

[alanbaka]

I try to make my pf enable PPTP passthrough.
I have installed finckin and config pf:

rdr on $int_if proto tcp from any to any port pptp -> 127.0.0.1 port pptp
rdr on $int_if proto gre from any to any -> 127.0.0.1
pass in quick proto tcp from any to any port pptp flags S/SA keep state
pass out quick proto tcp from any to any port pptp flags S/SA keep state
pass in quick proto gre from any to any
pass out quick proto gre from any to any

When I try to connect to a PPTP server in Windows, the Connecting to vpn server windows will show up:

|
V
Verifying user name and password
|
V
Wait about 30 seconds ...
|
V
Disconnected
Error 619: A connection to the remote computer could not be established.so the port used for this connection was closed .........

When establishing the connect, pf show the connect at 1723 port and gre proto looks like the protocol can talk to the PPTP server.

gate2# pfctl -ss | grep gre
all gre 1.36.xxx.xxx -> 58.153.xxx.xxx       MULTIPLE:MULTIPLE
all gre 58.153.xxx.xxx -> 192.168.10.100       MULTIPLE:MULTIPLE
all gre 192.168.10.100 -> 58.153.xxx.xxx       SINGLE:NO_TRAFFIC
gate2# pfctl -ss | grep :1723
all tcp 127.0.0.1:1723 <- 58.153.xxx.xxx:1723 <- 192.168.10.100:59323       ESTABLISHED:ESTABLISHED
all tcp 1.36.xxx.xxx:62339 -> 58.153.xxx.xxx:1723       ESTABLISHED:ESTABLISHED

I have tested with the PPTP server by using a normal home router with PPTP passthrough on, it can establish the connection.

What config am I missing?
I saw on the internet it look like the finckin works perfect with pf.

 

[hshh]

I have never made finckin work. I have to NAT protocol GRE by IPFW instead of PF. As my post on pfSense forum, http://forum.pfsense.org/index.php?topic=46172.0, you can try it.

ipfw enable in-kernel nat, kernel conf:
options LIBALIAS
options IPFIREWALL_NAT
or load module, kldload libalias; kldload ipfw_nat


pf rules:
no nat on $ext_if proto gre from any to any

ipfw rules:
ipfw nat 1 config if $ext_if same_ports reset unreg_only
ipfw add 1000 nat 1 gre from any to any

now, outbound pptp can be simultaneous.