diff --git a/include/Makefile b/include/Makefile
index 3df3f2a82bc5..40bb82f79b15 100644
--- a/include/Makefile
+++ b/include/Makefile
@@ -113,11 +113,13 @@ copies:
 		${INSTALL} -C -o ${BINOWN} -g ${BINGRP} -m 444 $i/*.h \
 		${DESTDIR}/usr/include/$i
 .endfor
+.if !defined(NO_IPFILTER)
 .if exists(${.CURDIR}/../sys/contrib/ipfilter/netinet)
 	cd ${.CURDIR}/../sys/contrib/ipfilter/netinet; \
 		${INSTALL} -C -o ${BINOWN} -g ${BINGRP} -m 444 *.h \
 		${DESTDIR}/usr/include/netinet
 .endif
+.endif
 .if exists(${.CURDIR}/../sys/contrib/netsmb/include/netsmb)
 	cd ${.CURDIR}/../sys/contrib/netsmb/include/netsmb; \
 		${INSTALL} -C -o ${BINOWN} -g ${BINGRP} -m 444 ${NETSMBHDRS} \
diff --git a/sbin/Makefile b/sbin/Makefile
index 443bb2210889..cf0d54e7e343 100644
--- a/sbin/Makefile
+++ b/sbin/Makefile
@@ -29,11 +29,7 @@ SUBDIR=	adjkerntz \
 	ifconfig \
 	init \
 	ip6fw \
-	ipf \
-	ipfs \
-	ipfstat \
 	ipfw \
-	ipmon \
 	kldconfig \
 	kldload \
 	kldstat \
@@ -80,6 +76,14 @@ SUBDIR=	adjkerntz \
 	umount \
 	vinum
 
+.if !defined(NO_IPFILTER)
+SUBDIR+=ipf \
+	ipfs \
+	ipfstat \
+	ipmon \
+	ipnat
+.endif
+
 .if ${MACHINE_ARCH} == "i386"
 SUBDIR+=cxconfig \
 	kget \
diff --git a/share/examples/Makefile b/share/examples/Makefile
index 35f35464782d..d2cd800dd59a 100644
--- a/share/examples/Makefile
+++ b/share/examples/Makefile
@@ -41,7 +41,10 @@ etc-examples:
 .endif
 
 .if ${SHARED} != "symlinks"
-SUBDIR=	ipfilter smbfs
+SUBDIR=	smbfs
+.if !defined(NO_IPFILTER)
+SUBDIR+=ipfilter
+.endif
 .endif
 
 .include <bsd.subdir.mk>
diff --git a/share/examples/etc/make.conf b/share/examples/etc/make.conf
index 076cd590b27e..7516e80fbd7e 100644
--- a/share/examples/etc/make.conf
+++ b/share/examples/etc/make.conf
@@ -95,6 +95,7 @@
 #NO_FORTRAN=	true	# do not build g77 and related libraries
 #NO_GDB=	true	# do not build GDB
 #NO_I4B=	true	# do not build isdn4bsd package
+#NO_IPFILTER=	true	# do not build IP Filter package
 #NO_LPR=	true	# do not build lpr and related programs
 #NO_MAILWRAPPER=true	# do not build the mailwrapper(8) MTA selector
 #NO_MODULES=	true	# do not build modules with the kernel
diff --git a/share/man/man5/make.conf.5 b/share/man/man5/make.conf.5
index 71da97f74d9c..89795d62e97f 100644
--- a/share/man/man5/make.conf.5
+++ b/share/man/man5/make.conf.5
@@ -370,6 +370,9 @@ and related libraries.
 .It Va NO_I4B
 .Pq Vt bool
 Set to not build isdn4bsd package.
+.It Va NO_IPFILTER
+.Pq Vt bool
+Set to not build IP Filter package.
 .It Va NO_LPR
 .Pq Vt bool
 Set to not build
diff --git a/sys/modules/Makefile b/sys/modules/Makefile
index c186d52b507c..54a6e8370bfb 100644
--- a/sys/modules/Makefile
+++ b/sys/modules/Makefile
@@ -41,7 +41,6 @@ SUBDIR=	3dfx \
 	if_vlan \
 	ip6fw \
 	ip_mroute_mod \
-	ipfilter \
 	ipfw \
 	ispfw \
 	joy \
@@ -114,6 +113,10 @@ SUBDIR=	3dfx \
 	wb \
 	xl
 
+.if !defined(NO_IPFILTER)
+SUBDIR+=ipfilter
+.endif
+
 #removed while KSE settles in:
 #	ncp \
 #	nwfs \
diff --git a/usr.sbin/Makefile b/usr.sbin/Makefile
index 4cb446d89e5c..422a5fce9f1e 100644
--- a/usr.sbin/Makefile
+++ b/usr.sbin/Makefile
@@ -38,9 +38,6 @@ SUBDIR=	IPXrouted \
 	ifmcstat \
 	inetd \
 	iostat \
-	ipresend \
-	ipsend \
-	iptest \
 	jail \
 	kbdcontrol \
 	kbdmap \
@@ -127,6 +124,13 @@ SUBDIR=	IPXrouted \
 	ypset \
 	zic
 
+.if !defined(NO_IPFILTER)
+SUBDIR+=ipftest \
+	ipresend \
+	ipsend \
+	iptest
+.endif
+
 .if !defined(NOLIBC_R) && ${MACHINE_ARCH} != "ia64"
 SUBDIR+=pppctl
 .endif