m0n0wall is always based on FreeBSD -RELEASE versions, never -STABLE (since what exactly -STABLE is depends very much on the exact point in time that the sources were checked out). However, in order to get the latest security patches, the release maintenance branches are used. For FreeBSD 4.11-RELEASE, this is RELENG_4_11. You'll have to use cvsup to get the latest patches.
The easiest way to do this is to use the package:
pkg_add -r cvsup-without-gui rehash
copy the example supfile
cp /usr/share/examples/cvsup/stable-supfile /etc/supfile
modify /etc/supfile
choose a nearby cvsup host (where it says "CHANGE_THIS")
set tag=RELENG_4_11 (instead of
RELENG_4)
add the line
ports-all tag=.
to the end of the file to update the ports collection too