Доброго времени суток!
Долго боролся с ipfw+natd рещил реализовать на ipf+ipnat
поэтому думаю на этой связке и остановиться осваиваю  freebsd с помощью различных доков читаю форумы ну и естественно пробую всё это на практике при возникших проблемах решал сам но вот думаю обратиться за помощью (не скромничать)
и поделиться проблемой:
есть шлюз на FreeBSD6.0(192.168.1.1) на нём squid,sendmail... две сет. карты xl0(внешний interface), fxp(внутренний interface),
локальная сеть 192.168.1.0/24
есть машина в локальной сети под управлением FreeBSD6.0(192.168.1.2)
Задача:  пробросить http трафик на машину 192.168.1.2
и поднять squid на этой машине при этом на шлюзе тоже должен работать squid и раздавать internet, интересует как сделать forwarding на 192.168.1.2

ват так не получилось

на шлюзе
/usr/src/sys/i386/conf/PROXY
.........
options IPFILTER
options IPFILTER_LOG
options IPFILTER_DEFAULT_BLOCK

/etc/rc.conf
.....
ipfilter_enable="YES"
ipfilter_rules="/etc/ipf.rules"
ipmon_enable="YES"
ipmon_flags="-Ds"

ipnat_enable="YES"
ipnat_rules="/etc/ipnat.rules"

/etc/ipf.rules

#    lo0 - loopback
#    fxp0 - internal to private network
#    xl0 - external to cable modem

# +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
# Interface: all
# Block all incoming and outgoing packets unless they're allowed later.
# +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
block in log all
block out log all

# -------------------------------------------------------------------------
# Interface: lo0
# Allow loopback to flow freely.
# -------------------------------------------------------------------------
pass in quick on lo0 all
pass out quick on lo0 all
# -------------------------------------------------------------------------

# -------------------------------------------------------------------------
# Interface: fxp0
# Allow internal traffic to flow freely.
# -------------------------------------------------------------------------
pass in quick on fxp0 all
pass out quick on fxp0 all
# -------------------------------------------------------------------------

pass out quick on xl0 proto tcp from any to any port = 21 flags S keep state keep frags
# [smtp to outside world]
pass out quick on xl0 proto tcp from any to any port = 25 flags S keep state keep frags
# [whois to outside world]
pass out quick on xl0 proto tcp from any to any port = 43 flags S keep state keep frags
# [domain to outside world]
pass out quick on xl0 proto tcp from any to any port = 53 flags S keep state keep frags
pass out quick on xl0 proto udp from any to any port = 53 keep state keep frags
# [http to outside world]
pass out quick on xl0 proto tcp from any to any port = 80 flags S keep state keep frags
# [pop3 to outside world]
pass out quick on xl0 proto tcp from any to any port = 110 flags S keep state keep frags
# [https to outside world]
pass out quick on xl0 proto tcp from any to any port = 443 flags S keep state keep frags
# [passive ftp to outside world step 2 where the FTP server decides which port
# for ftp data back]
pass out quick on xl0 proto tcp from any to any port > 1023 flags S keep state keep frags
# [traceroute to outside world 1st stage: probing...man traceroute(8)]
pass out quick on xl0 proto udp from any to any port 33434 >< 33525 keep state keep frags
# [ping to outside world]
pass out quick on xl0 proto icmp from any to any keep state keep frags
# -------------------------------------------------------------------------
# Allow _external_ initiated connections from outside world to hosts behind
# NAT and the firewall.
# -------------------------------------------------------------------------
# [dhclient]
pass in quick on xl0 proto udp from any to any port = 68 keep state keep frags
# [traceroute to internal host 2nd stage: receiving error code of icmp-type 3
# (destination unreachable) and icmp-type 11 (time exceeded)]
pass in quick on xl0 proto icmp from any to any icmp-type 3 keep state keep frags
pass in quick on xl0 proto icmp from any to any icmp-type 11 keep state keep frags

# -------------------------------------------------------------------------
# Interface: xl0
# Since there are no permit(pass) rules at this stage, everything else is
# blocked!
# -------------------------------------------------------------------------

/etc/ipnat.rules

#
# Interface:
#    xl0 - external

map xl0 192.168.1.2/32 -> 0.0.0.0/32 portmap tcp/udp 40000:60000

map xl0 192.168.1.2/32 -> 0.0.0.0/32