As with the current GENERIC, PFIL_HOOKS are not enabled by default. Any reasons for this? I dont know abotu the ipfw module, but the ipfilter module (ipl) can not load without PFIL in kernel. Perhaps it could be made default in GENERIC? Erik