[SNIP]

> from nmap from an outside host:
> ...
> 68/udp     open        bootpc
> ...

This is because dhcp listens on bpf which is before ipf (seen from
outside). So requests and answers wont go through the in-kernel
ip stack and so also not through ipf which listens in front of the ip stack.
Bye,

Mipam.