I still use ipfilter, but only as a NAT. Porting one of the others to OmniOS/illumos would require a lot of work. (Hell, part of me thinks writing a NAT-only hooks module would be easier.) My $.02, Dan