А перед 50м правилом ты никаких вроде-бы безобидных правил не вставлял?
Нет, тот что по дефолту был:
#!/bin/sh -
f='/sbin/ipfw'
ifOut='bce1'
#ifOut='re0 ng0 ng1'
ifVia=''
ifRecv=''
tmp_or=''
for i in $ifOut
do
ifVia="${ifVia}${tmp_or}via $i"
ifRecv="${ifRecv}${tmp_or}recv $i"
tmp_or=' or '
done
${f} -f flush
# dns, ххх.liqpay.com, liqpay.com
${f} table 100 add 8.8.8.8
${f} table 100 add 50.16.196.80
${f} table 100 add 107.21.122.223
# dns, ххх.liqpay.com, liqpay.com
${f} table 100 add 8.8.8.8
${f} table 100 add 50.16.196.80
${f} table 100 add 107.21.122.223
# mysql slave server cs.csmoney.net
${f} table 101 add 50.17.182.68
${f} add 50 allow tcp from any to me 22
${f} add 51 allow tcp from me 22 to any
${f} add 110 allow ip from any to any via lo0
${f} add 120 skipto 1000 ip from me to any
${f} add 130 deny icmp from any to any in icmptype 5,9,13,14,15,16,17
${f} add 160 skipto 2000 ip from any to me
${f} add 200 skipto 500 ip from any to any { $ifVia }
${f} add 300 skipto 4500 ip from any to any in
${f} add 400 skipto 450 ip from any to any { $ifRecv }
${f} add 420 divert 1 ip from any to any
${f} add 450 divert 2 ip from any to any
${f} add 490 allow ip from any to any
${f} add 500 skipto 32500 ip from any to any in
${f} add 510 divert 1 ip from any to any
${f} add 540 allow ip from any to any
${f} add 1000 allow udp from any 53,7723 to any
${f} add 1010 allow tcp from any to any setup keep-state
${f} add 1020 allow udp from any to any keep-state
${f} add 1100 allow ip from any to any
${f} add 2000 check-state
${f} add 2010 allow icmp from any to any
${f} add 2020 allow tcp from any to any 22,80,443,5006
${f} add 2030 allow tcp from "table(101)" to any 3306
${f} add 2050 deny ip from any to any { $ifVia }
${f} add 2060 allow udp from any to any 53,7723
${f} add 2100 deny ip from any to any
${f} add 4500 allow ip from any to "table(100)"
${f} add 32490 deny ip from any to any
${f} add 32500 allow ip from "table(100)" to any
