Решение найдено, ошибка в написании правил IPFW.
Привожу рабочий кусок правил, может кому и пригодится.rc.firewall
-----------------------------------------------
[Ss][Tt])
FwCMD="/sbin/ipfw"
LanOut="rl0"
LanIn="rl1"
IpOut="217.217.217.217"
IpIn="192.168.5.1"
NetMask="24"
NetIn="192.168.5.0"
#
${FwCMD} -f flush
${FwCMD} add check-state
#
${FwCMD} add allow ip from any to any via lo0
${FwCMD} add deny ip from any to 127.0.0.0/8
${FwCMD} add deny ip from 127.0.0.0/8 to any
#
${FwCMD} add deny ip from any to 10.0.0.0/8 in via ${LanOut}
${FwCMD} add deny ip from any to 172.16.0.0/12 in via ${LanOut}
${FwCMD} add deny ip from any to 192.168.0.0/16 in via ${LanOut}
${FwCMD} add deny ip from any to 0.0.0.0/8 in via ${LanOut}
#
${FwCMD} add deny ip from any to 169.254.0.0/16 in via ${LanOut}
#
${FwCMD} add deny ip from any to 240.0.0.0/4 in via ${LanOut}
#
${FwCMD} add deny icmp from any to any frag
#
${FwCMD} add deny log icmp from any to 255.255.255.255 in via ${LanOut}
${FwCMD} add deny log icmp from any to 255.255.255.255 out via ${LanOut}
#squid
${FwCMD} add fwd 127.0.0.1,3128 tcp from ${NetIn}/${NetMask} to any 80 via ${LanOut}
# (NAT)
${FwCMD} add divert natd ip from ${NetIn}/${NetMask} to any out via ${LanOut}
${FwCMD} add divert natd ip from any to ${IpOut} in via ${LanOut}
#
${FwCMD} add deny ip from 10.0.0.0/8 to any out via ${LanOut}
${FwCMD} add deny ip from 172.16.0.0/12 to any out via ${LanOut}
${FwCMD} add deny ip from 192.168.0.0/16 to any out via ${LanOut}
${FwCMD} add deny ip from 0.0.0.0/8 to any out via ${LanOut}
#
${FwCMD} add deny ip from 169.254.0.0/16 to any out via ${LanOut}
#
${FwCMD} add deny ip from 224.0.0.0/4 to any out via ${LanOut}
#
${FwCMD} add deny ip from 240.0.0.0/4 to any out via ${LanOut}
#
${FwCMD} add allow tcp from any to any established
#
${FwCMD} add allow ip from ${IpOut} to any out xmit ${LanOut}
# DNS
${FwCMD} add allow udp from any 53 to any via ${LanOut}
# DNS named
${FwCMD} add allow udp from any to any 53 via ${LanOut}
#
${FwCMD} add allow icmp from any to any icmptypes 0,8,11
# 80
${FwCMD} add allow tcp from any to ${IpOut} 80 via ${LanOut}
# 25 (SMTP)
${FwCMD} add allow tcp from any to ${IpOut} 25 via ${LanOut}
# 22 ssh
${FwCMD} add allow tcp from any to ${IpOut} 22 via ${LanOut}
# 143 IMAP
${FwCMD} add allow tcp from any to ${IpOut} 143 via ${LanOut}
# 110 POP
${FwCMD} add allow tcp from any to ${IpOut} 110 via ${LanOut}
${FwCMD} add allow tcp from any to any via ${LanIn}
# udp
${FwCMD} add allow udp from any to any via ${LanIn}
# icmp
${FwCMD} add allow icmp from any to any via ${LanIn}
;;
А по поводу squid.
Я так и остановился на версии сквида 2.5stable12.
Пробовал прозрачное проксирование работает, если добавить строки
httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on
У меня еще идет авторизация, а при прозрачном проксировании ПО клиента считает, что обращается напрямую к серверу и никогда не посылает заголовок Proxy-authorization. При этом очень не удобно использовать внешнюю программу авторизации. Это дело конечно вкуса и времени потраченного на настройку.
