pass in from localhost to localhost with short,frags
block in from any to any with ipopts
pass in from any to any with opt nop,rr,zsu
pass in from any to any with opt nop,rr,zsu not opt ssrr,lsrr
pass in from localhost to localhost and not frag
pass in from localhost to localhost with frags,frag-body
pass in proto tcp all flags S with not oow keep state
block in proto tcp all with oow
pass in proto tcp all flags S with not bad,bad-src,bad-nat
block in proto tcp all flags S with bad,not bad-src,not bad-nat
pass in quick all with not short
block in quick all with not nat
pass in quick all with not frag-body
block in quick all with not lowttl
pass in all with mbcast,not bcast,multicast,not state,not ipopts
block in all with not mbcast,bcast,not multicast,state
pass in from any to any with opt mtur,mtup,encode,ts,tr,sec,cipso,satid,ssrr,visa,imitd,eip,finn,dps,sdb,nsapa,rtralrt,ump,addext,e-sec