I am still doing something wrong, but can't see what.

I think the major clue is the last line in /var/log/messages:

Apr 20 19:29:41 base /netbsd: IP Filter: not initialized

and I don't know what to do about it. Other bits of info are:

base# modstat
Type    Id  Off Loadaddr Size Info     Rev Module Name
DEV       0  29 f87d0000 0015 f87d41cc   1 IP Filter v3.2alpha2
base# more ipfrule
count in
count out
pass in
pass out
block in from 131.111.8.48 mask 0xffffffff to any
base# telnet 131.111.8.48
...was a success...
base# ipfstat -hi
0 block in from 131.111.8.48/32 to any
base# ipfstat -ho
empty list for ipfilter(out)
base# ipfstat -ai
empty list for ipacct(in)
base# ipfstat -ao
empty list for ipacct(out)
base# ipfstat
 input packets:         blocked 0 passed 0 nomatch 0 counted 0
output packets:         blocked 0 passed 0 nomatch 0 counted 0
 input packets logged:  blocked 0 passed 0
output packets logged:  blocked 0 passed 0
 packets logged:        input 0 output 0
 log failures:          input 0 output 0
fragment state(in):     kept 0  lost 0
fragment state(out):    kept 0  lost 0
packet state(in):       kept 0  lost 0
packet state(out):      kept 0  lost 0
ICMP replies:   0       TCP RSTs sent:  0
Result cache hits(in):  0       (out):  0
IN Pullups succeeded:   0       failed: 0
OUT Pullups succeeded:  0       failed: 0
Packet log flags set: (0)
        none

In otherwords, nothing seems to happen. Any info appreciated!

Patrick