Ok so binat is not broken!! scrub on $ext_if all reassemble tcp scrub on $int_if all reassemble tcp fixed it.