So, like a soekris, CF, 486, multiple interfaces.
I've done it in 4-6MB, I've also got one running
256MB (man pages, X11 and I nfs mount to build - it was
on sale and the way to start a couple years ago).

All a readonly, mfs contains things (via link) like
resolv.conf, dhcpd-leases, /var/run/, /var/tmp, /tmp,
another MFS under /var/named/ is an area to hold secondary zones,
etc etc.

16MB or 32MB give you a fairly robust machine.

You can also poke at the m0n0wall project with has a lovely
thttpd interface (freebsd, reduced, no shells, firewall only).
Take ideas from things an move forward.

Soekris boxes may be the most well known ones from which you
can glean principles.

Quoting Paul Dokas (dokas@cs.umn.edu):
> 
> I've aquired an old Lucent Brick 80 that's basically a 486 class PC with
> CompactFlash instead of a disk drive and 4 Intel based NICs that I'd like
> to get working as a firewall.
> 
> What I think is the best approach is to get a trimmed down version of
> NetBSD onto the CF that is similar to the installation floppies.  Basically,
> the CF would hold a kernel that mounts and populates a memory disk (md(4))
> in the same sort of way that the installation floppies do.  However, I'm
> having a little trouble figuring out exactly how to build such a thing.
> 
> I know that I have to build a kernel with something like this:
> 
> options         MEMORY_DISK_HOOKS
> options         MEMORY_DISK_IS_ROOT     # force root on memory disk
> options         MEMORY_DISK_SERVER=0    # no userspace memory disk support
> options         MEMORY_DISK_ROOT_SIZE=4600      # size of memory disk, in blocks
> 
> but how to actually populate this space is beyond me.  I've dug through
> /usr/src/distrib/, but it's like the maze in adventure (Twisty little
> passages, all look the same...)  What happens in there to actually create
> the boot floppies is not clear.  Can anyone please shed a little light on
> how the i386 boot floppies are actually created?  I'd like to do something
> similar, probably by hand, to get NetBSD onto this device.
> 
> Paul
> -- 
> Paul Dokas                                            dokas@cs.umn.edu
> ======================================================================
> Don Juan Matus:  "an enigma wrapped in mystery wrapped in a tortilla."