Matthias has it right. But, if you had auto packet filter rule turned off in the VPN definition, your PF rule should have worked. The fact that it didn't indicates that you have another rule letting things through just as Matthias guessed.

The other thought I had when asking about the VPN was that for IPsec or SSL VPN, you could change 'Local networks' from 'Internal (Network)' to maquinas_elmec, and that would be all that was visible to the VPN.

Cheers - Bob

__________________
ACE V7 - Astaro Preferred Partner since V3
Addicted to my iPhone!