by adding WANT_IPFILTER to /etc/make.conf. Note that this is only a partial hack and only works when building the world and kernel the 'sanctioned' way. I hope that this hack is only temporary and can be reverted soon.