I had two problems:
1) I had missed in the config file 
options         PFIL_HOOKS      # pfil(9) packet filter hooks
(had included the pseudo-device   ipfilter                # IP filter)

and Scott Bartram pointed out (thanks)
2) not running ipf -E

Should this be included in the ipnat manual entry page?
johnh...

On Mon, 20 Oct 1997, Scott Bartram wrote:

> I just asked the same question about 3-4 days ago...
> 
> My problem was that I forgot to run "ipf -E" to enable ipfilter even
> though I wasn't loading any filters at the time.
> 
> Scott Bartram
> scottb@orionsoft.com
> http://www.orionsoft.com/
> 
> On Mon, 20 Oct 1997, John C. Hayward wrote:
> 
> > Dear NetBSDers,
> >    I am attempting to get ipnat working to allow machines on my local lan
> > to be able to access the internet via my internet connection.  
...