NPF: newbie experiencing some strange behavior

["g.lister" <g.lister%nodeunit.com@localhost>]

Hello guys,

I am trying to setup a gateway for a small home network using NetBSD and 
after buying and reading "The book of PF (2ed)" I saw a few 
presentations on NPF and its multi-threaded design and the fact that it 
will be NetBSD's default firewall and decided to use that instead of PF.

BTW is NPF really going to be the only firewall/packet filter supported 
in future releases??

Currently I have setup a bunch of net service (named, dhcp, nat) and 
managed to get all necessary NPF modules loaded (npf, npf-log, ...) but 
I seem to be having some kind of a newbie issue or experiencing some 
kind of a bug/problem.

Here is a small take out from what is happening:

gkpr# npfctl show
Filtering:      active
Configuration:  loaded

table <1> type hash


group (name "internal_net", interface wm0) {
        block in all
        pass in final from <1>
        pass stateful in final proto tcp to 192.168.1.18 port 40200 apply "log"
        pass out final all
}

group (default) {
        pass final on lo0 all
        block all
}
gkpr# npfctl table 1 list
192.168.1.7
192.168.1.11
192.168.1.15
192.168.1.19
192.168.1.8
192.168.1.12
192.168.1.16
192.168.1.20
192.168.1.1
192.168.1.5
192.168.1.9
192.168.1.13
192.168.1.17
192.168.1.2
192.168.1.6
192.168.1.10
192.168.1.14
192.168.1.18
127.0.0.1
gkpr# host yahoo.com localhost
;; connection timed out; no servers could be reached
gkpr# /etc/rc.d/npf stop
Disabling NPF.
gkpr# host yahoo.com localhost
Using domain server:
Name: localhost
Address: 127.0.0.1#53
Aliases:

yahoo.com has address 98.138.253.109
yahoo.com has address 98.139.183.24
yahoo.com has address 206.190.36.45
yahoo.com mail is handled by 1 mta7.am0.yahoodns.net.
yahoo.com mail is handled by 1 mta5.am0.yahoodns.net.
yahoo.com mail is handled by 1 mta6.am0.yahoodns.net.
gkpr#

I think the 'pass final on lo0 all' should be quick-evaluated (no 
further rule processing should be done) and connectivity to the local 
named server should not be an issue... the snippet is straight from the 
examples.

I tried playing around with different settings in the config removing 
stuff and adding stuff to see which might be the offending definition as 
my intentions and setup are quite detailed so I simplified to what I 
think are bare bones and as soon as I turn NPF on things don't work 
network wise.

Any hints or ideas are welcome!
Thanks in advance.
Kind regards,
george