New "pf" packet filter No longer ship ipf Can still be installed by the user Mostly compatible with ipf rule syntax Easy conversion of ipf-based filters Extended and modified where needed Tightly integrated into the networking stack IPv6 support Also does NAT and port redirection Packet normalization