» Freebsd84 ipfw+squid - smtp pop tls-ssl

Здравствуйте!
Настроил сервер под управлением FreeBSD84, настроил squid. Все прекрасно
работает, но вот почту в обход сквида на 25 smtp и 995 pop SSL-TLS никак не хочет отправлять, сразу оговорюсь - dns на контроллере домена, который также имеет выход в Интернет(пока что),
перепробовал ведро различных вариантов keep-state, established... уже 2-ую неделю бьюсь - не получается пока...

ядро собрал со следующими опциями:
options IPFIREWALL
options IPFIREWALL_VERBOSE
options IPFIREWALL_VERBOSE_LIMIT=1000
options IPFIREWALL_FORWARD
options DUMMYNET
options HZ=1000
options IPDIVERT
#----------------------------------------
rc.conf

hostname="proxy-server"
ifconfig_igb1="inet a.b.c.d netmask 255.255.255.128" #внешний ip
defaultrouter="a.b.c.1"
gateway_enable="yes"

#--- NAT ---

natd_enable="yes"
natd_interface="igb1"
natd_flags="-m -u"

#--- ---

ifconfig_igb0="inet 192.168.0.1 netmask 255.255.255.0"
keymap="us.unix"
firewall_enable="yes"
firewall_type="/etc/Firewall"
sshd_enable="yes"
squid_enable="YES"
#-----------------------------------------------------
Firewall
#-----------------
igb0 - LAN (вн.сеть)
igb1 - WAN (Интернет)
a.b.c.d - внешний ip-адрес (на igb1)
#-----------------

-q flush
-f flush
-f pipe flush
-f queue flush

5 add check-state
10 add allow ip from any to any via lo0
20 add deny ip from any to 127.0.0.0/8
30 add deny ip from 127.0.0.0/8 to any
45 add allow ip from any to any established #включил и сеть стала подтормаживать

47 add allow icmp from 192.168.0.0/24 to any keep-state
48 add allow ip from 192.168.0.0/24 to any 25 out via igb1 setup keep-state
49 add allow ip from 192.168.0.0/24 to any 995 out via igb1 setup keep-state

400 add deny ip from any to ::1
500 add deny ip from ::1 to any

550 add deny ip from me to any 137-139,445 out via igb1
1000 add allow ip from 192.168.0.0/24 to any out via igb1 keep-state

#1200 add deny ip from any to 10.0.0.0/8 in via igb1 #пока выключил
1300 add deny ip from any to 172.16.0.0/12 in via igb1
#1400 add deny ip from any to 192.168.0.0/16 in via igb1 #пока выключил
#1500 add deny ip from any to 0.0.0.0/8 in via igb1 #пока выключил

#-----рубим пакеты `типа от внутренней сети, но на внешнем интерфейсе------
1555 add deny ip from 192.168.0.0/24 to any in via igb1.

# -----------------------------------------------------------------------

1600 add deny ip from any to 169.254.0.0/16 in via igb1
1650 add deny ip from any to 224.0.0.0/8 in via igb1
1700 add deny ip from any to 240.0.0.0/8 in via igb1
1800 add deny icmp from any to any frag

#----------------- И еще одна попытка открыть почту через НАТ -------------------
1810 add allow tcp from any to any 25 via igb1
1820 add allow tcp from any 25 to any via igb1

#----------------Рубим 80 и 443 порты----------------------------------------
1850 add deny tcp from 192.168.0.0/24 to any 80 out via igb1 #только через proxy
1860 add deny tcp from 192.168.0.0/24 to any 443 out via igb1 #только через proxy

1900 add deny log icmp from any to 255.255.255.255 in via igb1
2000 add deny log icmp from any to 255.255.255.255 out via igb1

#------------------------ NAT---------------------------------------
2150 add divert natd ip from any to any via igb1
#2200 add divert 8668 ip from any to 192.168.0.0/24 in via igb1 #другой варинат ната
#---------------------------и еще раз почта---------------------------
#2202 add allow ip from any to any 25
#2203 add allow ip from any to any 995

# ---------------------- Еще одна попытка заставить заработать почту --------

#2220 add pass tcp from any 25, 995 to 192.168.0.0/24 via igb1
#2230 nat pass on igb1 from 192.168.0.0/24 to any port 25 -> igb1

#--------- Рубим трафик к частным сетям-----------------------------
#2300 add deny ip from 10.0.0.0/8 to any out via igb1 #пока выключил
2400 add deny ip from 172.16.0.0/16 to any out via igb1
#2500 add deny ip from 192.168.0.0/16 to any out via igb1 #пока выключил
#2600 add deny ip from 0.0.0.0/8 to any out via igb1 #пока выключил
2700 add deny ip from 169.254.0.0/16 to any out via igb1
2800 add deny ip from 224.0.0.0/4 to any out via igb1
2900 add deny ip from 240.0.0.0/4 to any out via igb1


3000 add allow ip from any to any established
3100 add allow ip from me to any out xmit igb1 keep-state
#--------------------DNS--------------------------------------------
3150 add allow udp from 192.168.0.0/24 to 8.8.8.8 53 out via igb1 keep-state
3300 add allow udp from 8.8.8.8 53 to 192.168.0.0/24 in via igb1 established
3400 add allow udp from 192.168.0.0/24 to any 53 out via igb1
#--------------------TIME-------------------------------------------
3500 add allow udp from any to any 123 via igb1
#---------------------FTP-------------------------------------------
3600 add allow tcp from any to any 20,21 out via igb1

3700 add allow tcp from any to a.b.c.d 49152-65535 via igb1
3800 add allow icmp from any to any icmptypes 0,8,11
#3810 add allow icmp from any to any out via igb1 icmptypes 0,8,11 setup keep-state
# 3850 add deny icmp from any to a.b.c.d in via igb1
3900 add allow tcp from any to a.b.c.d ssh via igb1

3910 add allow ip from any to 192.168.0.0/24 in via igb0
3920 add allow ip from 192.168.0.0/24 to any out via igb0
3930 add allow ip from any to any established

3950 add allow ip from any to any via igb0
# 3960 add allow tcp from any to any via igb0
# 3970 add allow udp from any to any via igb0
# 3980 add allow icmp from any to any via igb0

#----------------------------ICQ-----------------------------------------
#9000 add allow tcp from 192.168.0.0/24 to any 5190 in via igb0 setup

10000 add deny log tcp from any to a.b.c.d in via igb1 setup
65530 add deny log ip from any to any

GURUs I need your HELP, парни помогите!!!

# ipfw -a list
00005 0 0 check-state
00010 166696 29233680 allow ip from any to any via lo0
00020 0 0 deny ip from any to 127.0.0.0/8
00030 0 0 deny ip from 127.0.0.0/8 to any
00045 6415962 5598536751 allow ip from any to any established
00047 382 29256 allow icmp from 192.168.0.0/24 to any keep-state
00048 50 2520 allow ip from 192.168.0.0/24 to any dst-port 25 out via igb1 setup keep-state
00049 955 48132 allow ip from 192.168.0.0/24 to any dst-port 995 out via igb1 setup keep-state
00400 0 0 deny ip from any to ::1
00500 0 0 deny ip from ::1 to any
00550 177 13806 deny ip from me to any dst-port 137-139,445 out via igb1
01000 1105 55692 allow ip from 192.168.0.0/24 to any out via igb1 keep-state
01300 0 0 deny ip from any to 172.16.0.0/16 in via igb1
01555 0 0 deny ip from 192.168.0.0/24 to any in via igb1
01600 0 0 deny ip from any to 169.254.0.0/16 in via igb1
01650 0 0 deny ip from any to 224.0.0.0/8 in via igb1
01700 0 0 deny ip from any to 240.0.0.0/8 in via igb1
01800 0 0 deny icmp from any to any frag
01810 6 256 allow tcp from any to any dst-port 25 via igb1
01820 0 0 allow tcp from any 25 to any via igb1
01850 0 0 deny tcp from 192.168.0.0/24 to any dst-port 80 out via igb1
01860 0 0 deny tcp from 192.168.0.0/24 to any dst-port 443 out via igb1
01900 0 0 deny log logamount 200 icmp from any to 255.255.255.255 in via igb1
02000 0 0 deny log logamount 200 icmp from any to 255.255.255.255 out via igb1
02150 12296 824413 divert 8668 ip from any to any via igb1
02400 0 0 deny ip from 172.16.0.0/16 to any out via igb1
02700 0 0 deny ip from 169.254.0.0/16 to any out via igb1
02800 0 0 deny ip from 224.0.0.0/4 to any out via igb1
02900 0 0 deny ip from 240.0.0.0/4 to any out via igb1
03000 0 0 allow ip from any to any established
03100 974945 628926121 allow ip from me to any out xmit igb1 keep-state
03150 0 0 allow udp from 192.168.0.0/24 to 8.8.8.8 dst-port 53 out via igb1 keep-state
03300 0 0 allow udp from 8.8.8.8 53 to 192.168.0.0/24 in via igb1 established
03400 0 0 allow udp from 192.168.0.0/24 to any dst-port 53 out via igb1 established
03500 12 479 allow udp from any to any dst-port 123 via igb1
03600 0 0 allow tcp from any to any dst-port 20,21 out via igb1
03700 4 160 allow tcp from any to a.b.c.d dst-port 49152-65535 via igb1
03800 8 634 allow icmp from any to any icmptypes 0,8,11
03900 0 0 allow tcp from any to a.b.c.d dst-port 22 via igb1
03910 299897 37429734 allow ip from any to 192.168.0.0/24 in via igb0
03920 286860 28291872 allow ip from 192.168.0.0/24 to any out via igb0
03930 0 0 allow ip from any to any established
03950 2063 401601 allow ip from any to any via igb0
10000 481 21616 deny log logamount 200 tcp from any to a.b.c.d in via igb1 setup
65530 485 69019 deny log logamount 200 ip from any to any
65535 895701 64933042 deny ip from any to any

00048 50 2520 allow ip from 192.168.0.0/24 to any dst-port 25 out via igb1 setup keep-state
00049 955 48132 allow ip from 192.168.0.0/24 to any dst-port 995 out via igb1 setup keep-state
это вряд ли до ната дойдет, т.к. тут
02150 12296 824413 divert 8668 ip from any to any via igb1
исходящий адрес должен быть изменен, и только тогда выпускать во внешку.

может так?
00048 50 2520 allow ip from 192.168.0.0/24 to any dst-port 25,995 in via igb0

и воще что за natd?
проще ipfw nat.

сделал, но пакеты назад не возвращаются...

02050 6 304 allow ip from 192.168.0.0/24 to any dst-port 25,995 in via igb0
02055 0 0 allow ip from any 25,995 to 192.168.0.0/24 via igb0
02100 6 304 divert 8668 ip from 192.168.0.0/24 to any out via igb1
02110 117 22925 divert 8668 ip from any to a.b.c.d in via igb1

Пробовал и вместо 48 строки ставить - результат тот же...

ну попробуй простейший нат:

kldload ipfw_nat
ipfw nat 101 config if igb1
ipfw add 11010 nat 101 ip from any to any via igb1
ipfw add 11020 allow ip from any to any
ipfw add 1 skipto 11000 ip from any to any

так работает?