enabled (ipf -E) before ipnat is used; this detail is automated by the
rc scripts, but not by ipnat itself. ipf's author agrees this is a doc
bug.
Closes PR kern/33409.
format and fix PR#8932 while I am here.
Thanks to Darren for letting me know that it was gone.
We should just move to mandoc, but that makes it harder to keep it in sync
with the releases, so I made the changes in the old format.