If you arrive early at Surabaya Airport, I suggest you head directly to Probolinggo or Malang.
Surabaya city isn't an interesting place

Suggest you also ask in Tripadvisor.com. Locals can give you better answer.
BTW, I assume it's from West to East

Kawah Ijen, Malang
Unless you are interested in Sampoerna cigarette factory, you may skip Surabaya city.

You can ask your hotel to arrange for group tour.
And, if you can get people to share the cost, hire a 4x4 to visit the nearby villages. I didn't manage to do that

Oh yes, if time permitting, visit Kawah Ijen too. Give Surabaya city a pass unless you are interested in cigarette factory.

Try to ask in tripadvisor.com
Myself used public transport.

This post has been edited by river.sand: Mar 17 2015, 09:24 AM

My own itinerary was:
D1: arriving in Surabaya, spent the night at city center (near the not-so-Chinese China Town)
D2: take cab to bus station; take bus to Probolinggo, then take mini bus to a small town near Bromo
D3: Bromo sunrise tour; after that depart for Ijen Crater
D4: visiting Ijen Crater in the morning, then return to Probolinggo
D5: take bus to Malang
D6: return to Surabaya Airport; depart for Malaysia

On retrospect, I found Surabaya to be disappointing. I suggest that you go straight to Probolinggo and spend your first night there. Catch a mini bus to Bromo the next morning.
If you hire driver, you may head to Bromo on the first day.

Note that I joined a group tour to Ijen Crater. I asked the hotel front desk to arrange for it. My 3rd day was particularly hectic, as I rushed to Ijen Crater after the Bromo sunrise tour (also arranged by the hotel), with just 1 hour for shower and breakfast. If you have extra time, spend another day in Bromo and visit nearby villages. You'll need a 4x4 for that.

Malang was a place to savor Javanese food as well as for shopping.

I haven't been to Madakaripura waterfall, so I can't commend on this.

gaerie84 has answered some of your questions...

4x4 is for visiting the villages around Bromo.

Is there any reason you must go to Ijen before Bromo? In my case, I went to Bromo first, and from there booked a trip to Ijen.
If you insist on going to Ijen first, you can book a trip at the bus station of Probolinggo.

gaerie84 mentions that it is a waste of time to stay in Probolinggo. Indeed it is a boring town (though I had a yummy ayam penyet there). But it is a convenient transit point. If you can't get to the places of interest before sunset, you may spend a night there.

As for Surabaya, the only reason to go there is the cigarette factory

I took some pictures in Surabaya and Malang. See if you like them...
https://www.flickr.com/photos/kamera-otoko/...57625284306316/

Note that orang Tionghua of Surabaya have largely moved out of the Chinatown. I guess the same thing is happening to KL's Chinatown aka Jalan Petaling

This post has been edited by river.sand: Mar 17 2015, 02:06 PM

Forgot to add...
Mini buses from Probolinggo to Cemero Lawang have no fixed schedule, but instead depart only when they are full.

When I was there, the bus was not full. The other passengers and I decided to pay for the 'empty seats' to get the bus going.
But it turned out that the bus kept picking up passengers along the way. Before reaching Cemero Lawang, the bus was so full that some secondary school girl students had to hang outside it



This post has been edited by river.sand: Mar 18 2015, 09:23 AM

For buses from Probolinggo to Cemero Lawang, read here...
http://2point8.blogspot.com/2010/11/java-trip-iii.html

(note: info may not be up-to-date)

AFAIK, there is no public transport from Cemero Lawang to Bromo. You need to join a tour or hire a driver.