MacOS – NAT won’t start on 10.7 Server Mac Mini

OS X actually has (at least) 3 firewalls. Since you've turned off the application firewall (in System Preferences -> Security & Privacy -> Firewall) and checked the Berkeley packet filter (pfctl -sa), I'm guessing it's the old ipfw that's doing the blocking. You can check with sudo ipfw show -- that'll list the active rules, along with counts of how many packets and bytes each one has applied to:

$ sudo ipfw show
01000 19228642 23229993542 allow ip from any to any via lo0
01010        0           0 deny ip from any to 127.0.0.0/8
[etc...]
65534    23505     3467352 deny ip from any to any
65535        0           0 allow ip from any to any

If your listing only shows rule #65535 (the allow rule at the end), my guess is wrong and you have to look elsewhere. If it does show other rules, you probably have a third-party firewall config program installed somewhere (I don't think the Apple-supplied ipfw config software is still there in 10.8); take a look in /Library/StartupItems and /Library/LaunchDaemons for things that might be relevant.

Ok, got it. Upgrading Extreme to 7.6.3 might have been the root cause, but in addition I set up two wireless nets rather than one. Here is the set-up

CableModem -> Airport(Spaceship) running 11g serving DHCP values above 10.0.1.100 but accepting 10.0.1.xx with subnet mask. 11g given an obscure (private) name for the wireless account.

Spaceship -> Mac Mini via wire. Mac Mini with fixed address of 10.0.1.2

Mac Mini running internet sharing on 11n. Every wireless in the house able to connect via 11n. The 11n given a different (public) name for the wireless account and that's the wireless I tell friends visiting house.

AirportExtreme -> running in bridge mode, connecting via WDS to Spaceship, reading the 11g. Output on wire from the Extreme going to BoxWithNoWireless

BoxWithNoWireless requests DHCP and gets served an IP address from the Extreme.

Once all in place I did need to reboot the cable-modem too. Not sure why.

Not as clean as running a single 11n everywhere, however, and the BoxWithNoWireless is going to be running Netflix, etc, so I was really hoping to get 11n. But this at least gets me up-and-running.