Try ip filter; it's easy and powerful.
You can change directories into /etc/ipf. In there you will find a few files to edit. In 11/06 for instance, you have the file pfil.ap. Edit that file and uncomment the line with your network card type.
The ipf.conf file is the one where you put the rules of your firewall.
You can always create a file called ippool.conf to create pools (groups of ips for instance) and then implement rules (in ipf.conf) for the pools. Finally, you can create ipnat.conf for network address translation.
The main commands are ippool, ipf, ipfstat and ipnat.
You will have to unplumb the card and plumb it back up the first time (or reboot) to load the ipf module into the card (check this with ifconfig hme0 (for instance) modlist.
IPF is service based so type svcs -a | grep ipf and you should see two services (pfil and ipf). Have fun.