In my opinion, there should be only one packet filter/firewall in the kernel, with multiple clients - PF client, IPFW client, ipfilter client. People could write their own clients, and wouldn't have to touch the kernel at all. Petr