Привет спецам. В Фрюхе я новичок. Но пытаюсь сделать сам многое, Но видимо в Фрюхе Фаейрволл очент крутой или я чего то не догоняю.
мне нужно сделать Инет шлюз на для ста компьютеров.  Снаружи для сервера должен быть открыт доступ только для 22 порта и для 25 порта и для днс сервера на этом сервере,  нат  без него ни как ))) ну и потом можно будет сквид к нему прикрутить.
Вот мой конфиг.
В ядре опции:
options         IPFIREWALL                      # turn on firewall
options         IPFIREWALL_FORWARD              # FORWARD packet to another  program
options         IPFIREWALL_VERBOSE              # connection limit mode
options         IPFIREWALL_VERBOSE_LIMIT=500    # connection limit
options         IPFIREWALL_NAT                  # ipfw kernel nat support
options         LIBALIAS
options         IPDIVERT                        # turn on nat funtion
options         DUMMYNET                        # for routed flud info to nowhere
options         HZ=1000                         # how many packet we will see


потом в rc.conf  конфиге :

defaultrouter="222.222.222.22"
gateway_enable="YES"
hostname="хост.домейн.локал"
ifconfig_xl0_name="wan"
ifconfig_ed1_name="lan"
ifconfig_wan="inet 222.222.222.12 up netmask 255.255.255.х"
ifconfig_wan_alias0="inet 222.222.222.13 up netmask 255.255.255.х"
ifconfig_lan="inet 172.16.20.1 up netmask 255.255.255.0"
keymap="us.iso"
named_enable="YES"
named_program="/usr/sbin/named"
named_flags="-u bind -c /etc/namedb/named.conf"
sshd_enable="YES"
firewall_enable="YES"
firewall_logging="YES"
firewall_quiet="NO"
firewall_script="/etc/rc.firewall"
natd_enable="YES"
natd_interface="wan"
natd_flags="-m  -u"
log_in_vain="YES"

и сам конфиг фаерволла:


cat /etc/rc.firewall
# !/bin/sh -


FwCMD="/sbin/ipfw"  

LanOut="xl0"    
IpOut="222.222.222.12"
Netmask="х"

LanIn="ed1"            
IpIn="172.16.20.1"  
NetMask="24"            
NetIn="172.16.20.0"  


${FwCMD} -f flush

${FwCMD} add check-state




${FwCMD} add allow ip from any to any via lo0
${FwCMD} add deny ip from any to 127.0.0.0/8
${FwCMD} add deny ip from 127.0.0.0/8 to any




${FwCMD} add deny ip from any to 10.0.0.0/8 in via ${LanOut}
${FwCMD} add deny ip from any to 172.16.0.0/12 in via ${LanOut}
${FwCMD} add deny ip from any to 192.168.0.0/16 in via ${LanOut}
${FwCMD} add deny ip from any to 0.0.0.0/8 in via ${LanOut}
${FwCMD} add deny ip from any to 169.254.0.0/16 in via ${LanOut}

${FwCMD} add deny ip from any to 240.0.0.0/4 in via ${LanOut}

${FwCMD} add deny icmp from any to any frag

${FwCMD} add deny log icmp from any to 255.255.255.255 in via ${LanOut}
${FwCMD} add deny log icmp from any to 255.255.255.255 out via ${LanOut}

${FwCMD} add fwd ${IpIn},2121 tcp from ${NetIn}/${NetMask} to any 21 via ${LanOut}
${FwCMD} add fwd 127.0.0.1,3128 tcp from ${NetIn}/${NetMask} to any 80 via ${LanOut}


${FwCMD} add divert natd ip from ${NetIn}/${NetMask} to any out via ${LanOut}
${FwCMD} add divert natd ip from any to ${IpOut} in via ${LanOut}

${FwCMD} add deny ip from 10.0.0.0/8 to any out via ${LanOut}
${FwCMD} add deny ip from 172.16.0.0/12 to any out via ${LanOut}
${FwCMD} add deny ip from 192.168.0.0/16 to any out via ${LanOut}
${FwCMD} add deny ip from 0.0.0.0/8 to any out via ${LanOut}

${FwCMD} add deny ip from 169.254.0.0/16 to any out via ${LanOut}

${FwCMD} add deny ip from 224.0.0.0/4 to any out via ${LanOut}

${FwCMD} add deny ip from 240.0.0.0/4 to any out via ${LanOut}


${FwCMD} add allow tcp from any to any established
${FwCMD} add allow ip from ${IpOut} to any out xmit ${LanOut}

${FwCMD} add allow udp from any 53 to any via ${LanOut}
${FwCMD} add allow udp from any to any 123 via ${LanOut}
${FwCMD} add allow tcp from any to ${IpOut} 21 via ${LanOut}


# ${FwCMD} add allow tcp from any to ${IpOut} \
#`sysctl net.inet.ip.portrange.first | awk '{print $2}'`-\
#`sysctl net.inet.ip.portrange.last | awk '{print $2}'` via ${LanOut}
${FwCMD} add allow tcp from any to ${IpOut} 49152-65535 via ${LanOut}

${FwCMD} add allow icmp from any to any icmptypes 0,8,11

${FwCMD} add allow tcp from any to ${IpOut} 80 via ${LanOut}

# ${FwCMD} add allow tcp from any to ${IpOut} 25 via ${LanOut}

${FwCMD} add allow tcp from any to ${IpOut} 22 via ${LanOut}

# ${FwCMD} add allow tcp from any to ${IpOut} 143 via ${LanOut}

${FwCMD} add allow tcp from any to ${IpOut} 110 via ${LanOut}


# ${FwCMD} add allow ip from any to any via ${LanIn}


# ${FwCMD} add allow gre from any to any via ${LanIn}

${FwCMD} add allow tcp from any to any via ${LanIn}

${FwCMD} add allow udp from any to any via ${LanIn}

${FwCMD} add allow icmp from any to any via ${LanIn}

${FwCMD} add deny ip from any to any



что сделал не так  ? что нужно переделать ?  

спасибо всем заранее