Спасибо за ответы!

>порядок строк в /etc/rc.conf ес-но, не влияет на порядок старта скриптов.
>

   Да, об этом я уже догадался, пока набирал вопрос, но хотелось убедиться на 100% :-)

>так, во первых, кроме ipnat'a, что не работает еще?
>

   Сейчас не могу вспомнить, но по-моему были еще какие-то проблемы. Хотя, возможно, я погорячился.
   ipnat не работает точно!

>сюда желательно /etc/rc.conf и вывод ipfw show без перезапуска файрвола при ребуте
>

rc.conf:

font8x14="cp866-8x14"
font8x16="cp866b-8x16"
font8x8="cp866-8x8"
keymap="ru.koi8-r.shift.alt"
scrnmap="koi8-r2cp866"
mousechar_start="3"
saver="daemon"
keyrate="fast"
linux_enable="YES"

defaultrouter="a1.b1.c1.d1"
ifconfig_rl1="inet a.b.c.d netmask 255.255.255.252"
ifconfig_re0="inet 192.168.0.1 netmask 255.255.255.0"
ifconfig_rl0="inet 192.168.10.1 netmask 255.255.255.0"
hostname="serv.dom.com"
gateway_enable="YES"

named_enable="YES"

openvpn_enable="YES"
openvpn_if="tap"

sshd_enable="YES"

ipnat_enable="YES"
ipnat_rules="/etc/ipnat.rules"

inetd_enable="YES"

sendmail_enable="NO"
sendmail_submit_enable="NO"
sendmail_outbound_enable="NO"
sendmail_msp_queue_enable="NO"
postfix_enable="YES"
clamav_clamd_enable="YES"
clamsmtpd_enable="YES"
clamav_freshclam_enable="YES"
spamd_enable="YES"
saslauthd_enable="YES"
saslauthd_flags="-a pam"
tpop3d_enable="YES"

squid_enable="YES"

mysql_enable="YES"
apache22_enable="YES"

ntpd_enable="YES"
ntpd_program="/usr/sbin/ntpd"
ntpd_flags="-p /var/run/ntpd.pid"

firewall_enable="YES"
firewall_type="simple"
firewall_logging="YES"

   Правила после перезагрузки видны:

ipfw show:

00100  262   63882 allow ip from any to any via lo0
00200    0       0 deny ip from any to 127.0.0.0/8
00300    0       0 deny ip from 127.0.0.0/8 to any
00400   47    3582 allow ip from 192.168.3.0/28 to any
00500    0       0 allow ip from any to 192.168.3.0/28
00600    0       0 pipe 30 ip from 192.168.10.0/24 to any
00700    0       0 pipe 30 ip from any to 192.168.10.0/24
00800    0       0 pipe 30 ip from 192.168.0.252 to any dst-port 110
00900    0       0 pipe 30 ip from any 110 to 192.168.0.252
01000    0       0 pipe 30 ip from 192.168.0.253 to any dst-port 110
01100    0       0 pipe 30 ip from any 110 to 192.168.0.253
01200    0       0 deny ip from 192.168.10.1 to any in via rl1
01300    0       0 deny ip from a.b.c.d to any in via rl0
01400    0       0 deny ip from any to 10.0.0.0/8 via rl1
01500    0       0 deny ip from any to 172.16.0.0/12 via rl1
01600    0       0 deny ip from any to 192.168.0.0/16 via rl1
01700    0       0 deny ip from any to 0.0.0.0/8 via rl1
01800    0       0 deny ip from any to 169.254.0.0/16 via rl1
01900    0       0 deny ip from any to 192.0.2.0/24 via rl1
02000    1      28 deny ip from any to 224.0.0.0/4 via rl1
02100    0       0 deny ip from any to 240.0.0.0/4 via rl1
02200    0       0 deny ip from 10.0.0.0/8 to any via rl1
02300    0       0 deny ip from 172.16.0.0/12 to any via rl1
02400    0       0 deny ip from 192.168.0.0/16 to any via rl1
02500    0       0 deny ip from 0.0.0.0/8 to any via rl1
02600    0       0 deny ip from 169.254.0.0/16 to any via rl1
02700    0       0 deny ip from 192.0.2.0/24 to any via rl1
02800    0       0 deny ip from 224.0.0.0/4 to any via rl1
02900    0       0 deny ip from 240.0.0.0/4 to any via rl1
03000 3672 1233216 allow tcp from any to any established
03100    0       0 allow ip from any to any frag
03200   12     576 allow tcp from any to me dst-port 25 setup
03300    0       0 allow tcp from any to me dst-port 53 setup
03400    0       0 allow udp from any to me dst-port 53
03500    0       0 allow udp from me 53 to any
03600    0       0 allow tcp from any to me dst-port 80 setup
03700    0       0 allow tcp from a.b.c.d2 to me dst-port 22 setup
04000    0       0 allow tcp from 192.168.3.0/24 to me dst-port 22 setup
04100    0       0 allow tcp from me 22 to any
04200  113    6851 allow icmp from any to any icmptypes 0,3,5,8,11
04300    0       0 allow udp from me to any dst-port 33434-33600
04400  732   64797 allow udp from any to me dst-port 1195
04500  941  111646 allow udp from me 1195 to any
04600    0       0 allow tcp from a3.b3.c3.d4/28 to me dst-port 21 setup
04700    0       0 allow tcp from a3.b3.c3.d4/28 to me dst-port 20 setup
04800    6     288 allow tcp from any to me dst-port 110 setup
04900    0       0 allow tcp from any to me dst-port 4004
05000   13     624 deny log logamount 100 tcp from any to any in via rl1 setup
05100  306   15348 allow tcp from any to any setup
05200   80   12482 allow udp from me to any dst-port 53 keep-state
05300   21    1596 allow udp from me to any dst-port 123 keep-state
65535   23    1758 deny ip from any to any