The ipfw.ko and ipdivert.ko modules can be loaded from loader.conf too,
so add a short section that describes how to use the loader to achieve
the same effect as a kernel rebuild with:
options IPFIREWALL
options IPDIVERT
options IPFIREWALL_DEFAULT_TO_ACCEPT