приветствую, господа.
поставил netbsd 4.0, ipnat, ipfilter, squid. сконфигурил, всё вроде пашет, но вот dns-ы внутрь не хотят лезть. помогите, люди добрые :)
внутренняя сеть fxp0 - 192.168.10.0/24
внешняя vr0 - xxx.xxx.xxx.218/32

rc.conf
if [ -r /etc/defaults/rc.conf ]; then
. /etc/defaults/rc.conf
fi
rc_configured=YES
wscons=YES
sshd=YES
hostname="NetBSD.domainmain.ru"
domainname="domainmain.ru"
ifconfig_fxp0="inet 192.168.10.3 netmask 255.255.255.0"
ifconfig_vr0="inet xxx.xxx.xxx.218 netmask 255.255.255.252"
ntpdate=YES ntpdate_hosts="ru.pool.ntp.org"
clear_tmp=YES
syslogd=YES
syslogd_flags="-ss"
ipfilter=YES
ipnat=YES
ipfs=NO
defaultroute="xxx.xxx.xxx.217"

ipf.conf
# Interface:
# lo0 - loopback
# fxp0 - internal to private network
# vr0 - external to cable modem
block in log all
block out log all
pass in quick on lo0 all
pass out quick on lo0 all
pass in quick on fxp0 all
pass out quick on fxp0 all
pass out quick on vr0 proto tcp from any to any port = 21 flags S keep state keep frags
pass out quick on vr0 proto tcp from any to any port = 25 flags S keep state keep frags
pass out quick on vr0 proto tcp from any to any port = 43 flags S keep state keep frags
pass out quick on vr0 proto tcp from any to any port = 53 flags S keep state keep frags
pass out quick on vr0 proto udp from any to any port = 53 keep state keep frags
pass out quick on vr0 proto tcp from any to any port = 80 flags S keep state keep frags
pass out quick on vr0 proto tcp from any to any port = 110 flags S keep state keep frags
pass out quick on vr0 proto tcp from any to any port = 443 flags S keep state keep frags
pass out quick on vr0 proto tcp from any to any port > 1023 flags S keep state keep frags
pass out quick on vr0 proto udp from any to any port 33434 >< 33525 keep state keep frags
pass out quick on vr0 proto icmp from any to any keep state keep frags
pass in quick on vr0 proto udp from any to any port = 68 keep state keep frags
pass in quick on vr0 proto icmp from any to any icmp-type 3 keep state keep frags
pass in quick on vr0 proto icmp from any to any icmp-type 11 keep state keep frags

ipnat.conf
map vr0 192.168.10.0/24 -> xxx.xxx.xxx.218/32 proxy port ftp ftp/tcp
map vr0 192.168.10.0/24 -> xxx.xxx.xxx.218/32 portmap tcp/udp auto
map vr0 192.168.10.0/24 -> xxx.xxx.xxx.218/32

подскажите, где может быть косяк?