I should be sure to include the ipfw antispoof option, implemented by Andre Oppermann in FreeBSD's ipfw, at work