i am running nat on my freeBSD and web/ftp server.
The rule allow ip from any to any must always be? or how? if i accept all packets to go on my ep0 which diverts all to my intranet it doesnt help, must the rule allow ip from any to any always be ?
even if many rules are between divert rule and allow from any to any rule, system still be able easy hacked 
p.s. sorry for my lang.
FreeBSD firewall has a default rule numbered 65535, which is "allow all from any to any" or "deny all from any to any" depending on a kernel option [IPFIREWALL_DEFAULT_TO_ACCEPT], when this option is set you will have an open system. You can enable nat and firewall too, and define different rules for each interface, your web server should not be affected. Try these lines for your server:
ipfw add pass tcp from any to any established
ipfw add pass tcp from any to me 80 via {$ext_if} keep-state
For detailed information see ipfw man page and natd man page
sorry i haven't said what i need properly. Now i try to.
i have the set of rules :
00050 divert 8668 ip from any to any via ed0
00200 deny ip from any to 127.0.0.0/8
00300 deny ip from 127.0.0.0/8 to any
00350 allow ip from 192.168.0.0/24 to any
00400 allow ip from any to 192.168.0.0/24
00900 allow ip from any to any
65535 deny ip from any to any
and even if i add these ones
00500 allow ip from x.x.x.x to 192.168.0.0/24
00550 allow ip from x.x.x.x to any via ep0
00600 allow ip from any to x.x.x.x via ep0
00800 allow ip from any to x.x.x.x
and then remove 900 rule , ipfw doesnt allow to work nat properly.
x.x.x.x - internet addres
ep0 - internal adapter
ed0 - external
look at this example, i can asure you it's working, is a modification made to the default /etc/rc.firewall :
[Ss][Ii][Mm][Pp][Ll][Ee])
############
# This is a prototype setup for a simple firewall. Configure this
# machine as a named server and ntp server, and point all the machines
# on the inside at this machine for those services.
############
dont_deny="my_very_best_friend"
# set these to your outside interface network and netmask and ip
oif="rl1"
onet="outside_net_address"
omask="255.255.255.240"
oip="outside_ip_addr"
# set these to your inside interface network and netmask and ip
iif="rl0"
inet="internal_net_address"
imask="255.255.255.0"
iip="internal_ip"
# Stop spoofing
${fwcmd} add deny all from ${inet}:${imask} to any in via ${oif}
${fwcmd} add deny all from ${onet}:${omask} to any in via ${iif}
# Stop RFC1918 nets on the outside interface
${fwcmd} add deny all from any to 10.0.0.0/8 via ${oif}
${fwcmd} add deny all from any to 172.16.0.0/12 via ${oif}
${fwcmd} add deny all from any to 192.168.0.0/16 via ${oif}
# Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
# DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
# on the outside interface
${fwcmd} add deny all from any to 0.0.0.0/8 via ${oif}
${fwcmd} add deny all from any to 169.254.0.0/16 via ${oif}
${fwcmd} add deny all from any to 192.0.2.0/24 via ${oif}
${fwcmd} add deny all from any to 224.0.0.0/4 via ${oif}
${fwcmd} add deny all from any to 240.0.0.0/4 via ${oif}
######### RULES BEFORE NAT ######################
# Allow access for iserver
#${fwcmd} add pass tcp from 192.168.10.10 to any out setup
# Allow access for SIMM-3
#${fwcmd} add pass tcp from 192.168.10.20 to any out setup
# Deny everything else
#${fwcmd} add deny all from 192.168.0.0/24 to any setup
#
#######################################################################
# Network Address Translation. This rule is placed here deliberately
# so that it does not interfere with the surrounding address-checking
# rules. If for example one of your internal LAN machines had its IP
# address set to 192.0.2.1 then an incoming packet for it after being
# translated by natd(8) would match the `deny' rule above. Similarly
# an outgoing packet originated from it before being translated would
# match the `deny' rule below.
case ${natd_enable} in
[Yy][Ee][Ss])
if [ -n "${natd_interface}" ]; then
${fwcmd} add divert natd all from any to any via ${natd_interface}
fi
;;
esac
# Stop RFC1918 nets on the outside interface
${fwcmd} add deny all from 10.0.0.0/8 to any via ${oif}
${fwcmd} add deny all from 172.16.0.0/12 to any via ${oif}
${fwcmd} add deny all from 192.168.0.0/16 to any via ${oif}
# Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
# DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
# on the outside interface
${fwcmd} add deny all from 0.0.0.0/8 to any via ${oif}
${fwcmd} add deny all from 169.254.0.0/16 to any via ${oif}
${fwcmd} add deny all from 192.0.2.0/24 to any via ${oif}
${fwcmd} add deny all from 224.0.0.0/4 to any via ${oif}
${fwcmd} add deny all from 240.0.0.0/4 to any via ${oif}
#### RULES AFTER NAT ##########################
${fwcmd} add pass tcp from any to me 113
${fwcmd} add pass tcp from me 113 to any
# ${fwcmd} add pass tcp from me to any via ${iif} keep-state
##################################################################
# Don't deny address[es]
${fwcmd} add pass all from ${dont_deny} to any
${fwcmd} add pass all from any to ${dont_deny}
# Allow TCP through if setup succeeded
${fwcmd} add pass tcp from any to any established
# Allow IP fragments to pass through
${fwcmd} add pass all from any to any frag
# Allow setup of incoming email
${fwcmd} add pass tcp from any to ${oip} 25 setup
# Allow access to our DNS
${fwcmd} add pass tcp from any to ${oip} 53 setup
${fwcmd} add pass udp from any to ${oip} 53
${fwcmd} add pass udp from ${oip} 53 to any
# Allow access to our WWW
${fwcmd} add pass tcp from any to ${oip} 80 setup
# Allow access to Webmin
${fwcmd} add pass tcp from any to ${oip} 3129 setup
# SSH
${fwcmd} add pass tcp from any to ${oip} 22 setup
# FTP
${fwcmd} add pass tcp from any to ${oip} 21 setup
# FTP-data
${fwcmd} add pass tcp from any to ${oip} 20 setup
# SMTP
${fwcmd} add pass tcp from any to ${oip} 25 setup
# POP3
${fwcmd} add pass tcp from any to ${oip} 110 setup
# Reject&Log all setup of incoming connections from the outside
${fwcmd} add deny log tcp from any to any in via ${oif} setup
# Allow setup of any other TCP connection
${fwcmd} add pass tcp from any to any setup
# Allow DNS queries out in the world
${fwcmd} add pass udp from ${oip} to any 53 keep-state
# Allow NTP queries out in the world
${fwcmd} add pass udp from ${oip} to any 123 keep-state
# Everything else is denied by default, unless the
# IPFIREWALL_DEFAULT_TO_ACCEPT option is set in your kernel
# config file.
;;
added code tags for readability --oombera