Есть FreeBSD 6.2 + ipfw + ipnat.

Правила фаервола:

#!/bin/sh
#Quietly flush out rules
#/usr/local/etc/list_tmp/ua.sh
/sbin/ipfw -q -f flush
cmd="/sbin/ipfw add"
fwcmd="/sbin/ipfw"
oif="em0"
iif="em1"
skip="skipto 800"
outip="10.1.100.2"
         $cmd allow ip from any to any via lo0
         $cmd deny ip from any to 127.0.0.0/8
         $cmd deny log ip from 127.0.0.0/8 to any

         $cmd allow tcp from any to any 80 in via $oif
         $cmd allow tcp from any to any 22 in via $oif setup keep-state

#FTP
         $cmd allow tcp from any to any 20,21 in via $oif
         $cmd pass tcp from any to me 50000-59999 setup
#NTP
         $cmd allow udp from any to any 123 out via $oif
         $cmd allow udp from 83.218.226.67 to any in via $oif
#DNS external

         $cmd allow udp from any to any 53 in via $oif
         $cmd allow udp from any to any 53 out via $oif
         $cmd allow udp from any to $outip in via $oif

#         $cmd allow tcp from any to any out via $oif setup keep-state
#         $cmd allow udp from any to any out via $oif keep-state

###SHAPING

         $fwcmd table 1 add 192.168.32.0/24
# UA-IX Bandwidth control

         $fwcmd pipe 1 config bw 1024Kbit/s queue 8 mask dst-ip 0xffffffff # in

         $fwcmd pipe 2 config bw 512Kbit/s queue 8 mask src-ip 0xffffffff # out

# World Bandwidth control

         $fwcmd pipe 3 config bw 512Kbit/s queue 8 mask dst-ip 0xffffffff # in

         $fwcmd pipe 4 config bw 128Kbit/s queue 8 mask src-ip 0xffffffff # out

## Pipes work

         $cmd pipe 2 ip from table\(1\) to table\(0\) keep-state out via ${oif}
         $cmd pipe 4 ip from table\(1\) to not table\(0\) keep-state out via ${oif}

#        $cmd divert natd all from table\(1\) to any out via $oif
#        $cmd divert natd all from table\(1\) to any in via $iif
#        $cmd divert natd all from any to 10.1.100.2 in via $oif

         $cmd pipe 1 ip from table\(0\) to table\(1\) in via ${oif}
         $cmd pipe 3 ip from not table\(0\) to table\(1\) in via ${oif}

#####ICMP stuff
         $cmd check-state
         $cmd allow all from any to me in via $iif setup keep-state
         $cmd allow icmp from any to any icmptypes 3
         $cmd allow icmp from any to any icmptypes 4
         $cmd allow icmp from any to any icmptypes 11
         $cmd allow icmp from any to any icmptypes 8
         $cmd allow icmp from any to any icmptypes 0
         $cmd allow tcp from any to any established
         $cmd allow ip from $outip to any out xmit $oif
         $cmd deny log tcp from any to $outip in via $oif setup
# Тут разрешаем юзверям инет, которым он разрешен
         $cmd allow tcp from table\(1\) to not table\(1\) in via $iif setup

##### This section is for exposing services to the internet from the LAN
#####  It is placed AFTER the NATD Divert rule, so these services can be
#####  diverted in /etc/natd.conf
         $cmd allow ip from table\(1\) to table\(1\) in via em1
         $cmd allow ip from table\(1\) to table\(1\) in via em1
         $cmd 65000 deny log logamount 1000 all from any to any

table\(1\) --- локальная сеть
table\(0\) --- зона UA-IX

Правила IPNAT :

cat /etc/ipnat.rules
map  em1 0/0 -> 0/32 proxy port ftp ftp/tcp
map  em0 192.168.32.0/24 -> 10.1.100.2 proxy port ftp ftp/tcp
map  em0 192.168.32.0/24 -> 10.1.100.2

Проблема -- пакеты не попадают в pipe :(((

[root@bcp-gw /etc]# ipfw show
00100   0      0 allow ip from any to any via lo0
00200   0      0 deny ip from any to 127.0.0.0/8
00300   0      0 deny log logamount 5 ip from 127.0.0.0/8 to any
00400   0      0 allow tcp from any to any dst-port 80 in via em0
00500   0      0 allow tcp from any to any dst-port 22 in via em0 setup keep-state
00600   0      0 allow tcp from any to any dst-port 20,21 in via em0
00700   0      0 allow tcp from any to me dst-port 50000-59999 setup
00800   0      0 allow udp from any to any dst-port 123 out via em0
00900   0      0 allow udp from 83.218.226.67 to any in via em0
01000   0      0 allow udp from any to any dst-port 53 in via em0
01100   0      0 allow udp from any to any dst-port 53 out via em0
01200   0      0 allow udp from any to 10.1.100.2 in via em0
01300   0      0 pipe 2 ip from table(1) to table(0) out via em0 keep-state
01400   0      0 pipe 4 ip from table(1) to not table(0) out via em0 keep-state
01500   0      0 pipe 1 ip from table(0) to table(1) in via em0
01600   0      0 pipe 3 ip from not table(0) to table(1) in via em0
01700   0      0 check-state
01800   0      0 allow ip from any to me in via em1 setup keep-state
01900   0      0 allow icmp from any to any icmptypes 3
02000   0      0 allow icmp from any to any icmptypes 4
02100   0      0 allow icmp from any to any icmptypes 11
02200   0      0 allow icmp from any to any icmptypes 8
02300   0      0 allow icmp from any to any icmptypes 0
02400 104  16088 allow tcp from any to any established
02500   0      0 allow ip from 10.1.100.2 to any out xmit em0
02600   0      0 deny log logamount 5 tcp from any to 10.1.100.2 in via em0 setup
02700   0      0 allow tcp from table(1) to not table(1) in via em1 setup
02800   2    156 allow ip from table(1) to table(1) in via em1
02900   0      0 allow ip from table(1) to table(1) in via em1
65000   1    328 deny log logamount 1000 ip from any to any
65535 350 132492 allow ip from any to any

Скажите пожалуйста, как грамотно организовать правила, при условии работы с IPNAT что бы пакеты попадали в трубу ?

IPNAT - работает.
И еще одно, что отрабатывает раньше  IPNAT или IPFW.