День добрый,

может кто поможет с мелкой проблемой

/etc/rc.firewall

#!/bin/sh

FwCMD="/sbin/ipfw -q"

LanOut="ng0"
IpOut="ХХХ.ХХХ.ХХХ.ХХХ"

LanIn="xl0"
IpIn="192.168.1.5"
NetIn="192.168.1.0/24"
Ip_Lan="192.168.1"

VpnIf="ng1,ng2,ng3,ng4"

AllowTcpOutProtocols="80,443,25,110,21"
AllowInProtocols="22"

DNSList="80.82.32.9"

${FwCMD} -f flush
${FwCMD} -f pipe flush
${FwCMD} -f queue flush

${FwCMD} add allow ip from any to any via lo0

${FwCMD} add deny ip from any to 127.0.0.0/8
${FwCMD} add deny ip from 127.0.0.0/8 to any

${FwCMD} add deny ip from ${NetIn} to any in via ${LanOut}
${FwCMD} add deny ip from ${NetOut} to any in via ${LanIn}

${FwCMD} add deny ip from any to 10.0.0.0/8 in via ${LanOut}
${FwCMD} add deny ip from any to 172.16.0.0/12 in via ${LanOut}
${FwCMD} add deny ip from any to 192.168.0.0/16 in via ${LanOut}
${FwCMD} add deny ip from any to 0.0.0.0/8 in via ${LanOut}
${FwCMD} add deny ip from any to 169.254.0.0/16 in via ${LanOut}
${FwCMD} add deny ip from any to 224.0.0.0/4 in via ${LanOut}
${FwCMD} add deny ip from any to 240.0.0.0/4 in via ${LanOut}
${FwCMD} add deny icmp from any to any frag
${FwCMD} add deny log icmp from any to 255.255.255.255 in via ${LanOut}
${FwCMD} add deny log icmp from any to 255.255.255.255 out via ${LanOut}

#${FwCMD} add fwd 127.0.0.1,3128 tcp from ${NetIn} to any 80 via ${LanOut}

${FwCMD} add divert natd ip from ${NetIn} to any out via ${LanOut}
${FwCMD} add divert natd ip from any to ${IpOut} in via ${LanOut}

${FwCMD} add deny ip from 10.0.0.0/8 to any out via ${LanOut}
${FwCMD} add deny ip from 172.16.0.0/12 to any out via ${LanOut}
${FwCMD} add deny ip from 192.168.0.0/16 to any out via ${LanOut}
${FwCMD} add deny ip from 0.0.0.0/8 to any out via ${LanOut}
${FwCMD} add deny ip from 169.254.0.0/16 to any out via ${LanOut}
${FwCMD} add deny ip from 224.0.0.0/4 to any out via ${LanOut}
${FwCMD} add deny ip from 240.0.0.0/4 to any out via ${LanOut}

${FwCMD} add allow icmp from any to any icmptypes 0,8,11

${FwCMD} add allow ip from any to ${NetIn} in via ${LanIn}
${FwCMD} add allow ip from ${NetIn} to any out via ${LanIn}

${FwCMD} add allow tcp from any to any established

${FwCMD} add allow udp from any to ${IpOut} 53 in via ${LanOut}
${FwCMD} add allow udp from ${IpOut} 53 to any out via ${LanOut}
${FwCMD} add allow udp from any 53 to ${IpOut} in via ${LanOut}
${FwCMD} add allow udp from ${IpOut} to any 53 out via ${LanOut}
${FwCMD} add allow udp from any to any 123 via ${LanOut}

${FwCMD} add allow tcp from any to ${IpOut} 53 in via ${LanOut} setup
${FwCMD} add allow tcp from any to ${IpOut} 80 in via ${LanOut} setup
${FwCMD} add allow tcp from any to ${IpOut} 20,21 in via ${LanOut} setup
${FwCMD} add allow tcp from any to ${IpOut} 25 in via ${LanOut} setup
${FwCMD} add allow tcp from any to ${IpOut} 22 in via ${LanOut} setup
${FwCMD} add allow tcp from any to ${IpOut} 20,21 in via ${LanOut} setup

${FwCMD} add deny log tcp from any to ${IpOut} in via ${LanOut} setup

${FwCMD} add allow tcp from ${IpOut} to any out via ${LanOut} setup
${FwCMD} add allow tcp from any to ${IpOut} in via ${LanIn} setup

########### BEGIN USERS   ###############################

${FwCMD} add allow tcp from ${NetIn} to any 5190 in via ${LanIn} setup

${FwCMD} add allow tcp from ${Ip_Lan}.13 to not ${NetIn} in via ${LanIn} setup

############# END USERS #################################

${FwCMD} add deny ip from any to any

в rc.conf

# IPFW
firewall_enable="YES"
firewall_type="/etc/rc.firewall"
firewall_logging="YES"

все проблема во втором правиле ната

# NAT
natd_enable="YES"
natd_interface="ng0"
natd_flags=" -m -u"

${FwCMD} add allow ip from ${NetIn} to any out via ${LanIn}

оно ловит все пакеты на внешнем интерфейсе, где криво?

заранее спасибо