Не работает проброс портов в IPFW

uname -a
FreeBSD avtopromin.com.ua 9.2-RELEASE FreeBSD 9.2-RELEASE #0: Tue Jan 14 21:46:16 EET 2014     darksmoke@avtopromin.com.ua:/usr/obj/usr/src/sys/AVTOPROMIN  amd64

cat /etc/firewall.conf
#!/bin/sh
cmd="/sbin/ipfw"
wan="re0"
lan="em0"
wanip="xxx.xxx.xxx.xxx"
lanip="192.168.2.250"
server1c="192.168.2.240"

${cmd} -f flush
${cmd} add check-state

${cmd} add allow ip from any to any via lo0

${cmd} add deny ip from any to 127.0.0.0/8
${cmd} add deny ip from 127.0.0.0/8 to any
${cmd} add deny ip from any to 10.0.0.0/8 in via ${wan}
${cmd} add deny ip from any to 172.16.0.0/12 in via ${wan}
${cmd} add deny ip from any to 192.168.0.0/16 in via ${wan}
${cmd} add deny ip from any to 0.0.0.0/8 in via ${wan}
${cmd} add deny ip from any to 169.254.0.0/16 in via ${wan}
${cmd} add deny ip from any to 240.0.0.0/4 in via ${wan}
${cmd} add deny icmp from any to any frag
${cmd} add deny log icmp from any to 255.255.255.255 in via ${wan}
${cmd} add deny log icmp from any to 255.255.255.255 out via ${wan}

${cmd} add allow ip from any to ${lanip} 9999 via ${lan}
${cmd} add allow ip from any to ${wanip} 9999 via ${wan}

${cmd} nat 1 config if re0 reset same_ports deny_in redirect_port tcp 192.168.2.240:3389 3389
${cmd} add nat 1 ip from any to any via ${wan}

ipfw show
00100       0          0 check-state
00200       0          0 allow ip from any to any via lo0
00300       0          0 deny ip from any to 127.0.0.0/8
00400       0          0 deny ip from 127.0.0.0/8 to any
00500       0          0 deny ip from any to 10.0.0.0/8 in via re0
00600       0          0 deny ip from any to 172.16.0.0/12 in via re0
00700       0          0 deny ip from any to 192.168.0.0/16 in via re0
00800       0          0 deny ip from any to 0.0.0.0/8 in via re0
00900       0          0 deny ip from any to 169.254.0.0/16 in via re0
01000       0          0 deny ip from any to 240.0.0.0/4 in via re0
01100       0          0 deny icmp from any to any frag
01200       0          0 deny log logamount 500 icmp from any to 255.255.255.255 in via re0
01300       0          0 deny log logamount 500 icmp from any to 255.255.255.255 out via re0
01400       0          0 allow ip from any to 192.168.2.250 dst-port 9999 via em0
01500       0          0 allow ip from any to 78.25.1.195 dst-port 9999 via re0
01600     614      49120 nat 1 ip from any to any via re0
65535 6767586 4512460054 allow ip from any to any

Почему не работает?