Есть : FreeBSD 7 + nat (в ядре) + pipes
Проблема - пакеты проходят в трубу, натятся и скорость не падает :(
table 1 -Local net
table 0 - UA-IX сегмент

Конфиг IPFW
#!/bin/sh
#Quietly flush out rules
#/usr/local/etc/list_tmp/ua.sh
/sbin/ipfw -q -f flush
cmd="/sbin/ipfw add"
fwcmd="/sbin/ipfw"
oif="em0"
iif="em1"
skip="skipto 800"
outip="10.1.100.2"
NatIP="10.1.100.2"
         $cmd allow ip from any to any via lo0
         $cmd deny ip from any to 127.0.0.0/8
         $cmd deny log ip from 127.0.0.0/8 to any

         $cmd allow tcp from any to any 80 in via $oif
         $cmd allow tcp from any to any 22 in via $oif setup keep-state

#FTP
         $cmd allow tcp from any to any 20,21 in via $oif
         $cmd pass tcp from any to me 50000-59999 setup
#NTP
         $cmd allow udp from any to any 123 out via $oif
         $cmd allow udp from 83.218.226.67 to any in via $oif
#DNS external

         $cmd allow udp from any to any 53 in via $oif
         $cmd allow udp from any to any 53 out via $oif
         $cmd allow udp from any to $outip in via $oif

#         $cmd allow tcp from any to any out via $oif setup keep-state
#         $cmd allow udp from any to any out via $oif keep-state

###SHAPING

         $fwcmd table 1 add 192.168.32.0/24
# UA-IX Bandwidth control

         $fwcmd pipe 1 config bw 1024Kbit/s mask dst-ip 0xffffffff # in

         $fwcmd pipe 2 config bw 512Kbit/s mask src-ip 0xffffffff # out

# World Bandwidth control

         $fwcmd pipe 3 config bw 512Kbit/s mask dst-ip 0xffffffff # in

         $fwcmd pipe 4 config bw 128Kbit/s mask src-ip 0xffffffff # out

## Pipes work
         $cmd pipe 2 ip from table\(1\) to table\(0\) out via ${oif}
         $cmd pipe 4 ip from table\(1\) to not table\(0\) out via ${oif}

         $cmd pipe 1 ip from table\(0\) to table\(1\) in via ${oif}
         $cmd pipe 3 ip from not table\(0\) to table\(1\) in via ${oif}

         $fwcmd nat 123 config ip ${NatIP} log
         $cmd nat 123 ip from table\(1\) to any out via $oif
         $cmd nat 123 ip from any to ${NatIP} in via $oif
#####ICMP stuff
         $cmd check-state
         $cmd allow all from any to me in via $iif setup keep-state
         $cmd allow icmp from any to any icmptypes 3
         $cmd allow icmp from any to any icmptypes 4
         $cmd allow icmp from any to any icmptypes 11
         $cmd allow icmp from any to any icmptypes 8
         $cmd allow icmp from any to any icmptypes 0
         $cmd allow tcp from any to any established
         $cmd allow ip from $outip to any out xmit $oif
         $cmd deny log tcp from any to $outip in via $oif setup
# Тут разрешаем юзверям инет, которым он разрешен
         $cmd allow tcp from table\(1\) to not table\(1\) in via $iif setup

##### This section is for exposing services to the internet from the LAN
#####  It is placed AFTER the NATD Divert rule, so these services can be
#####  diverted in /etc/natd.conf
         $cmd allow ip from table\(1\) to table\(1\) in via em1
         $cmd allow ip from table\(1\) to table\(1\) in via em1
#         $cmd pipe 2 ip from table\(1\) to table\(0\) out via ${oif}
#         $cmd pipe 4 ip from table\(1\) to not table\(0\) out via ${oif}

#        $cmd divert natd all from table\(1\) to any out via $oif
#        $cmd divert natd all from table\(1\) to any in via $iif
#        $cmd divert natd all from any to 10.1.100.2 in via $oif
#         $cmd pipe 1 ip from table\(0\) to table\(1\) in via ${oif}
#         $cmd pipe 3 ip from not table\(0\) to table\(1\) in via ${oif}

         $cmd 65000 deny log logamount 1000 all from any to any

При тестировании смотрю
ipfw show
[root@bcp-gw ~/backup]# ipfw show
00100      0        0 allow ip from any to any via lo0
00200      0        0 deny ip from any to 127.0.0.0/8
00300      0        0 deny log ip from 127.0.0.0/8 to any
00400      0        0 allow tcp from any to any dst-port 80 in via em0
00500      0        0 allow tcp from any to any dst-port 22 in via em0 setup keep-state
00600      0        0 allow tcp from any to any dst-port 20,21 in via em0
00700      0        0 allow tcp from any to me dst-port 50000-59999 setup
00800      0        0 allow udp from any to any dst-port 123 out via em0
00900      0        0 allow udp from 83.218.226.67 to any in via em0
01000      0        0 allow udp from any to any dst-port 53 in via em0
01100      2      117 allow udp from any to any dst-port 53 out via em0
01200      2     1415 allow udp from any to 10.1.100.2 in via em0
01300  23646  1050965 pipe 2 ip from table(1) to table(0) out via em0
01400    302    41574 pipe 4 ip from table(1) to not table(0) out via em0
01500      0        0 pipe 1 ip from table(0) to table(1) in via em0
01600      0        0 pipe 3 ip from not table(0) to table(1) in via em0
01700  23948  1092539 nat 123 ip from table(1) to any out via em0
01800  34877 44698010 nat 123 ip from any to 10.1.100.2 in via em0
01900      0        0 check-state
02000      0        0 allow ip from any to me in via em1 setup keep-state
02100      0        0 allow icmp from any to any icmptypes 3
02200      0        0 allow icmp from any to any icmptypes 4
02300      0        0 allow icmp from any to any icmptypes 11
02400      0        0 allow icmp from any to any icmptypes 8
02500      0        0 allow icmp from any to any icmptypes 0
02600 118119 91724654 allow tcp from any to any established
02700    133     6384 allow ip from 10.1.100.2 to any out xmit em0
02800      0        0 deny log tcp from any to 10.1.100.2 in via em0 setup
02900    133     6384 allow tcp from table(1) to not table(1) in via em1 setup
03000    250    30640 allow ip from table(1) to table(1) in via em1
03100      0        0 allow ip from table(1) to table(1) in via em1
65000      9     2952 deny log logamount 1000 ip from any to any
65535    426    43190 allow ip from any to any

ipfw pipe show
[root@bcp-gw ~/backup]# ipfw pipe show
00001:   1.024 Mbit/s    0 ms   50 sl. 0 queues (64 buckets) droptail
00002: 512.000 Kbit/s    0 ms   50 sl. 1 queues (64 buckets) droptail
    mask: 0x00 0xffffffff/0x0000 -> 0x00000000/0x0000
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp
20 ip    192.168.32.254/0             0.0.0.0/0     87057  3875922  0    0   0
00003: 512.000 Kbit/s    0 ms   50 sl. 0 queues (64 buckets) droptail
00004: 128.000 Kbit/s    0 ms   50 sl. 1 queues (64 buckets) droptail
    mask: 0x00 0xffffffff/0x0000 -> 0x00000000/0x0000
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp
20 ip    192.168.32.254/0             0.0.0.0/0     106642  4955582  0    0 27837

Пакеты вроде в трубу попадают .... направление в трубах указано, а скорость не режется :(