#!/bin/sh
fwcmd="/sbin/ipfw -q"
${fwcmd} -f flush
${fwcmd} add check-state
${fwcmd} add allow ip from any to any via lo0
${fwcmd} add deny ip from any to 127.0.0.0/8
${fwcmd} add deny ip from 127.0.0.0/8 to any
${fwcmd} add divert natd ip from 192.168.0.0/24 to any out via vr0
${fwcmd} add divert natd ip from any to any in via vr0
${fwcmd} add allow tcp from any to any established
${fwcmd} add allow ip from 10.12.1.74 to any out xmit vr0
${fwcmd} add allow udp from any 53 to any via vr0
${fwcmd} add allow udp from 10.12.1.74 to any 53 out via vr0
${fwcmd} add allow icmp from any to any icmptypes 0,8,11
${fwcmd} add allow tcp from any to any via vr1
${fwcmd} add allow udp from any to any via vr1
${fwcmd} add allow icmp from any to any via vr1


Как мы видим тут 192.168.0.* - внутрення сеть
10.12.1.74 - инет
vr0 - инет
vr1 - внутренняя сеть

Цель - NAT. Порты уж как нить сам проброшу..

__________________
...