Show the list of current NAT table entry mappings using ipnat -l
check if you have it here
/etc/ipf/ipnat.conf
/usr/local/etc/ipnat.conf
/usr/local/etc/ipf/ipnat.conf
Or ipnat.rules
Which version of FreeBSD are you using on the mail server?
Show the content of /etc/ipf.rules
Check if you have ipf.conf
Output of ipnat -l is below. Here is /etc/ipf.rules...
# Begin ipf ruleset
#
# outside interface = vr0
# inside interface = dc0
#
# Allow localhost traffic over the lo0 interface
#
pass in quick on lo0 from any to any
pass out quick on lo0 from any to any
#
# Block RFC-1918 and similar type spoof attempts
#
block in log quick on vr0 from 192.168.0.0/16 to any
block in log quick on vr0 from 172.16.0.0/12 to any
block in log quick on vr0 from 10.0.0.0/8 to any
block in log quick on vr0 from 127.0.0.0/8 to any
block in log quick on vr0 from 0.0.0.0/8 to any
block in log quick on vr0 from 169.254.0.0/16 to any
block in log quick on vr0 from 192.0.2.0/24 to any
block in log quick on vr0 from 204.152.64.0/23 to any
block in log quick on vr0 from 224.0.0.0/3 to any
#
# Allow traffic for DNS, web, and mail services
# Following 2 lines allow Ralph in
# pass in quick from 24.97.145.202/32 to any keep state
# pass out quick from any to 24.97.145.202/32 keep state
pass in quick proto tcp/udp from any to any port = domain keep state
pass out quick proto tcp/udp from any port = domain to any keep state
pass in quick proto tcp from any to 10.0.0.2/32 port = http keep state
pass out quick on dc0 proto tcp from any to 10.0.0.2/32 port = http keep state
pass in quick proto tcp from any to 10.0.0.2/32 port = https keep state
pass in quick proto tcp from any to any port = smtp keep state
pass in quick proto tcp from any to 64.36.56.98/32 port = pop3 keep state
pass in quick proto tcp from any to 64.36.56.98/32 port = imap keep state
#
# Allow ssh connections from selected outside hosts
#
#pass in quick on vr0 proto tcp from 69.205.50.120/32 to any port = ssh flags S keep state
#pass in quick on vr0 proto tcp from any to any port = ssh flags S keep state
#pass in quick on vr0 proto tcp from 69.251.190.98/32 to any port = ssh flags S keep state
#pass in quick on vr0 proto tcp from 68.32.116.93/32 to any port = ssh flags S keep state
#pass in quick on vr0 proto tcp from 68.32.119.76/32 to any port = ssh flags S keep state
#
# Allow ping and traceroute from selected hosts
#
#pass in quick on vr0 proto icmp from 69.205.50.120/32 to any keep state
pass in quick on vr0 proto icmp from any to any keep state
#pass in quick on vr0 proto icmp from 69.251.190.98/32 to any keep state
#pass in quick on vr0 proto icmp from 68.32.119.76/32 to any keep state
#
# Allow inside hosts to initiate connections to the outside and receive replies
#
pass in quick on dc0 from any to any keep state
pass out quick on vr0 from any to any keep state
#
# Block and log unwanted tcp udp and icmp connections
# Send tcp reset or host unreachable instead of nothing
#
block return-rst in log quick on vr0 proto tcp from any to any
block return-icmp-as-dest(port-unr) in log quick on vr0 proto udp from any to any
block return-icmp-as-dest(port-unr) in log quick on vr0 proto icmp from any to any
#
# Block and log everything else
#
block in log quick all
block out log quick all
#
# End ipf ruleset