problem of nocat + FreeBSD-4.8-ipfw2+timestamp-20030616.patch

hi list,
yes, i did a lot of searchs from this nocat list and google.
some many pepole say: he can install NoCat in FreeBSD!
but unfortunately, i made a mess.

i also used a patch from http://www.pogozone.net/projects/nocat/
below is my install process:
    Kernel built with options for ipfirewall, ipfirewall_verbose,
    ipfirewall_verbose_limit=100, ipfirewall_default_to_accept, ipdivert,
    ipfirewall_forward and dummynet.
download NoCatAuth-0.82.tar.gz and NoCatAuth-0.82+IPFW2-20030714.patch
    in FreeBSD4.8realese
# tar -zxf NoCatAuth-0.82.tar.gz
# cd NoCatAuth-0.82
# mv ../NoCatAuth-0.82+IPFW2-20030714.patch ./
# patch -p0 < NoCatAuth-0.82+IPFW2-20030714.patch
# make gateway

and edit nocat.conf for my need(run bridge mode).
for example:
    AuthServiceAddr the_other_one
    AuthServiceURL  https://$AuthServiceAddr/
    ExternalDevice  fxp0
    InternalDevice  bge0
    LocalNetwork    220.228.XX.128/26
    DNSAddr         168.95.X.X

my network interface config is
    fxp0: inet 220.228.XX.48 netmask 0xffffffc0 broadcast 220.228.XX.63
    bge0: inet 220.228.XX.181 netmask 0xffffffc0 broadcast 220.228.XX.191

then
# /usr/local/gw/bin/gateway
net.inet.ip.forwarding: 1 -> 1
net.link.ether.ipfw: 1 -> 1
00100 allow log logamount 10 ip from any to any via fxp0
00200 allow log logamount 10 ip from any to any via lo0
ipfw: invalid protocol ``layer2''
00300 allow log logamount 10 tcp from any to any 5280 in recv bge0
00400 allow log logamount 10 tcp from any to any 5280 out xmit bge0
00500 allow log logamount 10 tcp from any to any 22 in recv bge0
00600 allow log logamount 10 tcp from any to any 22 out xmit bge0
00700 allow log logamount 10 udp from any to 168.95.X.X 53 keep-state in
recv bge0
00800 allow log logamount 10 tcp from any to 220.228.XX.46 80,443 in
recv bge0
00900 fwd 220.228.XX.181,5280 log logamount 10 tcp from any to any
80,443 in recv bge0
01000 deny log logamount 10 ip from any to any in recv bge0
...

i lost "layer2" ipfw rule,
so i supposed all pocket must be captived by rule 900,
     i will see the authserv's web page.
but it was't work.

Thanks in advance.
amonrose