pf, ipfw и ipfilter вкомпилены в ядро
ipfw -> pf -> ipfilter -> stack - для входящего stack -> ipfilter -> pf -> ipfw - для исходящего
pf загружен как модуль ядра
pf -> ipfw -> ipfilter -> stack - для входящего stack -> ipfilter -> ipfw -> pf - для исходящего
PF will only use one processor, so multiple processors (or multiple cores) WILL NOT improve PF performance. HOWEVER, under some circumstances, running the SMP version of OpenBSD (bsd.mp) instead of bsd will give better performance due to differences in how interrupt handling is done. In many cases, bsd.mp will give less performance. IF you are seeing performance problems, experiment with this, most users will never hit any limits to worry about it.
http://www.openbsd.org/faq/pf/perf.html
=(
Sokolov blog