Squid & firewall

[killeo]

PF-2.0
включаю transparent squid, статистика есть.
у клиента internet-a нету.
пробовал как тут http://forum.pfsense.org/index.php/topic,26362.0.html
WAN - rl0 - xxx.xxx.xxx.95
LAN - rl1 - 192.168.11.2

fctl -sn
nat-anchor "natearly/" all
nat-anchor "natrules/" all
nat on rl0 inet from <tonatsubnets>port = isakmp to any port = isakmp -> xxx.xxx.xxx.95 port 500
nat on rl0 inet from <tonatsubnets>to any ->xxx.xxx.xxx.95 port 1024:65535
rdr-anchor "relayd/" all
rdr-anchor "tftp-proxy/" all
rdr on rl1 inet proto tcp from 192.168.11.0/24 to 192.168.11.2 port = http -> 127.0.0.1 port 3128
rdr-anchor "miniupnpd" all</tonatsubnets></tonatsubnets>

будет время:
http://forum.pfsense.org/index.php/topic,32494.0.html
http://forum.pfsense.org/index.php/topic,32661.0.html