Make the pf and ipfw firewalls start before netif, just like ipfilter

already does. This eliminates a logical inconsistency, and a small
window where the system is open after the network comes up.

etc/rc.d/ip6fw

@@ -5,7 +5,6 @@
 
 # PROVIDE: ip6fw
 # REQUIRE: routing
-# BEFORE: network_ipv6
 # KEYWORD: nojail
 
 . /etc/rc.subr

etc/rc.d/ipfilter

@@ -5,7 +5,6 @@
 
 # PROVIDE: ipfilter
 # REQUIRE: FILESYSTEMS
-# BEFORE:  netif
 # KEYWORD: nojail
 
 . /etc/rc.subr

etc/rc.d/ipfs

@@ -5,7 +5,6 @@
 
 # PROVIDE: ipfs
 # REQUIRE: ipnat
-# BEFORE:  netif
 # KEYWORD: nojail shutdown
 
 . /etc/rc.subr

etc/rc.d/ipfw

@@ -4,8 +4,7 @@
 #
 
 # PROVIDE: ipfw
-# REQUIRE: ppp
-# BEFORE: NETWORKING
+# REQUIRE: FILESYSTEMS
 # KEYWORD: nojail
 
 . /etc/rc.subr

etc/rc.d/ipnat

@@ -5,7 +5,6 @@
 
 # PROVIDE: ipnat
 # REQUIRE: ipfilter
-# BEFORE:  DAEMON netif
 # KEYWORD: nojail
 
 . /etc/rc.subr

etc/rc.d/netif

@@ -26,7 +26,8 @@
 #
 
 # PROVIDE: netif
-# REQUIRE: atm1 cleanvar ipfilter FILESYSTEMS serial sppp sysctl
+# REQUIRE: atm1 cleanvar FILESYSTEMS serial sppp sysctl
+# REQUIRE: ipfilter ipfs pf ipfw
 # KEYWORD: nojail
 
 . /etc/rc.subr

etc/rc.d/network_ipv6

@@ -29,7 +29,7 @@
 #
 
 # PROVIDE: network_ipv6
-# REQUIRE: routing
+# REQUIRE: routing ip6fw
 # KEYWORD: nojail
 
 . /etc/rc.subr

etc/rc.d/pf

@@ -4,7 +4,7 @@
 #
 
 # PROVIDE: pf
-# REQUIRE: FILESYSTEMS netif pflog pfsync
+# REQUIRE: FILESYSTEMS pflog pfsync
 # BEFORE:  routing
 # KEYWORD: nojail
 

etc/rc.d/pflog

@@ -4,7 +4,7 @@
 #
 
 # PROVIDE: pflog
-# REQUIRE: FILESYSTEMS netif cleanvar
+# REQUIRE: FILESYSTEMS cleanvar
 # KEYWORD: nojail
 
 . /etc/rc.subr

etc/rc.d/pfsync

@@ -4,7 +4,7 @@
 #
 
 # PROVIDE: pfsync
-# REQUIRE: FILESYSTEMS netif
+# REQUIRE: FILESYSTEMS
 # KEYWORD: nojail
 
 . /etc/rc.subr