помогите с ipfw

посмотри вывод ipfw show ( блин забыл уже ) и посмотри counter-ы -увидишь где что проходит . скорее всего порядок правил напутан .
или сделай по аналогии с этим.
http://www.rootshell.be/~alienge/html/ipfw_stateful.html

вот рабочий когда-то пример .
/etc/rc.fire

#!/bin/sh
ipfw="/sbin/ipfw -q"
#/sbin/ipfw -f flush
${ipfw} -f flush
#IPSEC
${ipfw} add 30 pass ip from any to any via gif0
${ipfw} add 31 pass udp from other_real_ip to real_ip isakmp
${ipfw} add 31 pass udp from real_ip to other_real_ip isakmp
${ipfw} add 31 pass esp from other_real_ip to real_ip
${ipfw} add 31 pass esp from real_ip to other_real_ip
${ipfw} add 31 pass ipencap from other_real_ip to real_ip
${ipfw} add 31 pass ipencap from real_ip to other_real_ip


${ipfw} add 60 pass ip from me to any
${ipfw} add 62 pass tcp from another_other_real_ip to me 443 # port 443 because I usualy put ssh on this port
${ipfw} add 63 pass tcp from other_real_ip to me 443
${ipfw} add 70 pass all from any to any via rl1 # rl1 my internal interface
#natd incoming packets

${ipfw} add 80 divert natd ip from any to real_ip
${ipfw} add 90 check-state
${ipfw} add 92 pass tcp from any to me 1024-65535
${ipfw} add 92 pass udp from any to me 1024-65535
${ipfw} add 92 pass icmp from any to me
${ipfw} add 95 pipe 1 tcp from any to 10.0.3.49 # pipe
${ipfw} pipe 1 config bw 4096kbit/s delay 0

#remember state for sessions subject to nat

${ipfw} add 100 skipto 60000 all from 10.0.3.0/24 to any out via rl0 keep-state

${ipfw} add 200 deny log all from any to any

${ipfw} add 60001 divert natd all from 10.0.3.10 to any out via rl0
${ipfw} add 60001 divert natd all from 10.0.3.25 to any out via rl0
${ipfw} add 60010 pass all from any to any