So, a bit of poking around trying to set up ipnat runs consistently into
EIO messages, with no kernel diagnostics at all.  Is it working for everyone
else?  Is anyone else having trouble?  ipfstat, etc., all give the same
behavior.

  1002 ipfstat  CALL  open(0x805167a,0,2)
  1002 ipfstat  NAMI  "/dev/ipl"
  1002 ipfstat  RET   open 7
  1002 ipfstat  CALL  ioctl(7,_IOWR('r',0x40,0x4),0xbfbfe5f8)
  1002 ipfstat  GIO   fd 7 wrote 4 bytes
       "\M^D\M-f\M-?\M-?"
  1002 ipfstat  RET   ioctl -1 errno 5 Input/output error

I don't see anything obvious to explain the error.  I think I have all the
relevant lines in my kernel config:

$ uname -a
NetBSD vash.cel.plethora.net 2.0F NetBSD 2.0F (VASH) #1: Thu Jun 17 20:23:20 CDT 2004  seebs@vash.cel.plethora.net:/usr/src/sys/arch/i386/compile/VASH i386
$ grep -i IPF VASH
options         IPFILTER_LOG    # ipmon(8) log support
#options        IPFILTER_DEFAULT_BLOCK  # block all packets by default
pseudo-device   ipfilter                # IP filter (firewall) and NAT
#options        BRIDGE_IPF              # bridge uses IP/IPv6 pfil hooks too

?

-s