Мучался тут... если долго.
Почитал оригинал статьи еще. У автора пара недочетов в скрипте. Выкладываю рабочий вариант. У меня на роутере стоит ntp сервер, dns сервер (кэширующий всего лишь), squid на порту 3129, mathopd (small http sever) ради банерорезки со статистикой на порту 8000, vsftpd на порту 2121 смотрящий и внутрь и в наружу. Natd запущен с ключами -s -u, в сквиде разрешены запросы от 192.168.0.0/24 То же самое в DNS сервере. Если не будет правила 1500, пакеты из natd пойдут прямиком на правило 3000, но сквид работать будет без вопросов. Вроде пояснил.

#!/bin/sh
ournet="192.168.0.0/24"
ourprefix="192.168.0"
ipout="xx.x.xx.xx"
ifout="ep0"
ifuser="rl0"
# CLEAR RULES
ipfw -q flush
# BEGIN FIREWALLING
ipfw add 10 check-state
# DENY PART I
ipfw add 11 deny icmp from any to any in icmptype 5,9,13,14,15,16,17
ipfw add 12 reject ip from ${ournet} to any in via ${ifout}
ipfw add 13 deny all from any to 255.255.255.255 via ${ifout}
ipfw add 14 deny all from any to 255.255.255.255 via ${ifuser}
ipfw add 16 deny udp from any to any 137,138 via ${ifout}
# THIS MUST BE
ipfw add 100 allow all from any to any via lo
ipfw add 101 allow ip from me to any keep-state via ${ifout}
#----------------- FOREIGN IN --------------------------------
# OUTSIDE DNS
ipfw add 121 allow udp from xx.x.x.x to me 53 in via ${ifout}
# OUTSIDE FTP
ipfw add 122 fwd 127.0.0.1,2121 tcp from any to me 20,21 in via ${ifout}
#----------------- LOCAL SECTION ----------------------------
# LOCAL DNS
ipfw add 150 allow udp from ${ournet} to me 53 in via ${ifuser}
# LOCAL NTP
ipfw add 151 allow udp from ${ournet} to me 123 in via ${ifuser}
# LOCAL FTP
ipfw add 152 fwd 127.0.0.1,2121 tcp from ${ournet} to me 20,21 in via ${ifuser}
# LOCAL HTTP
ipfw add 153 fwd 192.168.0.3,8000 tcp from ${ournet} to me 80 via ${ifuser}
#----------------- FORWARD SECTION -------------------------
# SQUID
ipfw add 299 fwd 127.0.0.1,3129 tcp from ${ournet} to any 80,443 out via ${ifout}
# NATD
ipfw add 300 divert natd all from any to any via ${ifout}
#------------------ USER SECTION ----------------------------
#ipfw add 1000 allow ip from any to ${ournet}
# MIROSLAV
ipfw add 1002 allow ip from ${ourprefix}.5 to any in via ${ifuser}
ipfw add 1003 allow ip from any to ${ourprefix}.5
# BANANMAC
ipfw add 1004 allow ip from ${ourprefix}.11 to any in via ${ifuser}
ipfw add 1005 allow ip from any to ${ourprefix}.11
# NOTEBOOK
ipfw add 1006 allow ip from ${ourprefix}.84 to any in via ${ifuser}
ipfw add 1007 allow ip from any to ${ourprefix}.84
# TEST PC
ipfw add 1008 allow ip from ${ourprefix}.10 to any in via ${ifuser}
ipfw add 1009 allow ip from any to ${ourprefix}.10
#--------------------------------------------------------------
# NATD OUT
ipfw add 1500 allow ip from ${ipout} to any out via ${ifout}
# DENY ANYTHING ELSE
ipfw add 3000 deny ip from any to any

>А как быть с ftp
#!/bin/sh
ournet="192.168.0.0/24"
ourprefix="192.168.0"
ipout="*.*.*.*"
ipuser="192.168.0.*"
ifout="xl0"
ifuser="xl1"
# CLEAR RULES
ipfw -q flush
ipfw -f pipe flush
ipfw -f queue flush
# BEGIN FIREWALLING
ipfw add 10 check-state
# DENY PART I
ipfw add 11 deny icmp from any to any in icmptype 5,9,13,14,15,16,17
ipfw add 12 reject ip from ${ournet} to any in via ${ifout}
ipfw add 14 deny all from any to 255.255.255.255
ipfw add 16 deny udp from any to any 137,138
# THIS MUST BE
ipfw add 30 allow all from any to any via lo
ipfw add 31 allow ip from me to any keep-state
#----------------- FOREIGN IN --------------------------------
# OUTSIDE FTP, FTPDATA
ipfw add 43 allow tcp from any to me 20,21,49153 in via ${ifout}
#----------------- LOCAL SECTION ----------------------------
# LOCAL DNS, NTP
ipfw add 50 allow udp from ${ournet} to me 53,123 in via ${ifuser}
# LOCAL FTP, SSH, HTTP, FTPDATA
ipfw add 55 allow tcp from ${ournet} to me 20,21,22,8000,49153 in via ${ifuser}
#----------------- FORWARD SECTION -------------------------
# SQUID
ipfw add 59 fwd 127.0.0.1,3129 tcp from ${ournet} to any 80 out via ${ifout}
# NATD
ipfw add 60 divert natd all from any to any via ${ifout}
#------------------ USER SECTION ----------------------------
# LOCAL ICMP
ipfw add 70 allow icmp from ${ournet} to any in via ${ifuser}
ipfw add 71 allow icmp from any to ${ournet}
# LOCAL ICQ
ipfw add 80 allow tcp from ${ournet} to any 5190 in via ${ifuser}
ipfw add 81 allow tcp from any 5190 to ${ournet}
#--------------------------------------------------------------
# USER DUMMYNET OUT
ipfw pipe 1 config bw 128Kbit/s
ipfw queue 1 config pipe 1 weight 50 queue 20 mask src-ip 0xffffffff
# USER DUMMYNET IN
ipfw pipe 2 config bw 128Kbit/s
ipfw queue 2 config pipe 2 weight 50 queue 40 mask dst-ip 0xffffffff
# DUMMYNET USER
ipfw add 59901 queue 1 ip from ${ournet} to any in via ${ifuser}
ipfw add 59902 queue 2 ip from any to ${ournet}
#--------------------------------------------------------------
# OUTSIDE ICMP
ipfw add 59998 allow icmp from any to me in via ${ifout}
# GLOBAL OUT
ipfw add 59999 allow ip from ${ipout} to any out via ${ifout}
# DENY ANYTHING ELSE WITH LOGGING
ipfw add 60000 deny ip from any to any

правило за номером 43 и vsftpd. proftpd тоже сойдет: нужен ftp сервер с отстраиваемыми номерами портов.