Probleme mit pf config

[Tuxist]

Moin habe problem mit meiner pf config leider kann ich aus dem 200er netz rechner aus dem 123 Netz erreichen was nicht sein sollte und die weiterleitung von 192.168.123.71 zu 192.168.200.2 klappt auch nicht.
Die rechner aus dem 200er Netz habe auch keine Verbindung zum proxy.

# makros
ext_if="tun0"
int_if="vr0"
int_wlan="vr1"
IntNet="192.168.123.0/24" 
WlanNet="192.168.200.0/24"
WlanPorts_tcp="{5222,443,80,20,21}"
tcp_services="{113 23399 6891 6900 1863 6901}"
icmp_types="echoreq"

# optionen
set block-policy return
set loginterface $ext_if

set skip on lo

# scrub
#scrub in

#wlan alle augangs/eingangsports sperren
block in on $int_wlan all
block out on $int_wlan all

#wlan dhcp ports öffen
pass in on $int_wlan inet proto udp from $int_wlan port 68 keep state
pass out on $int_wlan inet proto udp from $int_wlan port 67 keep state

#WlanPorts zulassen
pass out on $int_wlan inet proto tcp to $ext_if port $WlanPorts_tcp

# nat/rdr ftp proxy
nat on $ext_if from !($ext_if) -> ($ext_if:0)
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"

# Active FTP - Umleitung zu unserem ftp-proxy
rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021
rdr pass on $int_wlan proto tcp to port ftp -> 127.0.0.1 port 8021

#webconfig accesspoint
nat on $int_if from 192.168.123.71/24 to $int_wlan -> 192.168.200.2
pass in on $int_wlan inet proto tcp from $int_if to 192.168.200.2 port www

#proxy umleitung port 80
rdr on $int_if inet proto tcp from any to any port www -> 127.0.0.1 port 3128
rdr on $int_wlan inet proto tcp from any to any port www -> 127.0.0.1 port 3128

#verbindung zum proxy zulassen
pass in on $int_if inet proto tcp from any to 127.0.0.1 port 3128 keep state
#ausgangsverbindungen zulassen
pass out on $ext_if inet proto tcp from any to any port www keep state

# Erschwert scannen mit nmap und co.
block in log quick on {$ext_if $int_wlan} inet proto tcp from any to any flags FUP/FUP
block in log quick on {$ext_if $int_wlan} inet proto tcp from any to any flags SF/SFRA
block in log quick on {$ext_if $int_wlan} inet proto tcp from any to any flags /SFRA
block in log quick on {$ext_if $int_wlan} os NMAP

# IP Spoofing verhindern
block in log quick on {$ext_if $int_wlan} inet from <NoRoute> to any
block in log quick on {$ext_if $int_wlan} inet from any to <NoRoute>

# MS-Geroedel blocken
block in quick on $int_if inet proto tcp from $IntNet to any port { 134 >< 140, 445 }
block in quick on $int_if inet proto udp from $IntNet to any port { 134 >< 140, 445 }

# filterregeln
block in

pass out keep state

anchor "ftp-proxy/*"
antispoof quick for { lo $int_if }

pass in on $ext_if inet proto tcp from any to ($ext_if) port $tcp_services flags S/SA keep state 

pass in inet proto icmp all icmp-type $icmp_types keep state

pass in quick on $int_if