Hello!

> You have to use PFIL_HOOKS _OR_ ipfilter.
> PFIL_HOOKS is for the lkm driver and the pseudo-device is for the
> kernel driver of ipf/ipnat.

Really? Then `man ipfilter` (or `man 4 ipl`) should be changed, as it states:

[...]
     This pseudo-device includes the PFIL_HOOKS option.
[...]

Or did I miss something obvious?

> > crw-------  1 root  wheel   18,   0 Aug 28 15:55 ipl

You may also need /dev/ipnat (which should be created if you do
`./MAKEDEV ipl` in /dev).

Greets
      Thorsten