Тюрьма FreeBSD с Петлевым IP, IPFW и natd - Исходящие соединения перестала работать из тюрьмы

The solution should have been obvious from the problem that the address translation was always occurring before state rules were checked. The address translation needs to be split.

The corrected version of the rules found above is:

add 00050 divert natd ip4 from any to any via wan0 in
add 00060 check-state

# Talking to myself
add 00200 allow ip from me to me keep-state

# HTTP
add 11010 skipto 63000 tcp from any to me http,https setup keep-state
add 11011 skipto 63000 tcp from any to me6 http,https setup keep-state

# General Network - ICMP
add 61001 allow icmp from any to any

# Last rule of "normal" traffic
add 62000 deny ip from any to any

# Only for my outbound and specifically allowed incoming
add 63000 divert natd ip from any to any via wan0 out
add 63001 allow ip from any to any

# XXX last rule is deny everything