Ok, I've bitten the bullet and switched to npf and altq. Setup seems to be working so far, and it's fixed another annoyance I recently noticed: ipf was blocking in-bound syn-acks from select remote sites. 99% of sites were fine, a handful of sites broke. It's all fine with npf.
-- Paul Ripke "Great minds discuss ideas, average minds discuss events, small minds discuss people." -- Disputed: Often attributed to Eleanor Roosevelt. 1948.
