@0 scrub from any to <vpn_networks:2> max-mss 1300 fragment no reassemble
  [ Evaluations: 369801207  Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@1 scrub from <vpn_networks:2> to any max-mss 1300 fragment no reassemble
  [ Evaluations: 369801207  Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@2 scrub on ix3 inet all fragment reassemble
  [ Evaluations: 369801207  Packets: 190295464  Bytes: 41093719935  States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@3 scrub on ix3 inet6 all fragment reassemble
  [ Evaluations: 2         Packets: 2         Bytes: 172         States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@4 scrub on igc0 inet all fragment reassemble
  [ Evaluations: 179505741  Packets: 179387810  Bytes: 41123691570  States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@5 scrub on igc0 inet6 all fragment reassemble
  [ Evaluations: 3339      Packets: 3339      Bytes: 518700      States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@6 scrub on ix2 inet all fragment reassemble
  [ Evaluations: 114592    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@7 scrub on ix2 inet6 all fragment reassemble
  [ Evaluations: 1         Packets: 1         Bytes: 116         States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@8 scrub on ix0 inet all fragment reassemble
  [ Evaluations: 114591    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@9 scrub on ix0 inet6 all fragment reassemble
  [ Evaluations: 2         Packets: 2         Bytes: 188         States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@10 scrub on ix1 inet all fragment reassemble
  [ Evaluations: 114589    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@11 scrub on ix1 inet6 all fragment reassemble
  [ Evaluations: 3         Packets: 3         Bytes: 244         States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@12 scrub on igc1 inet all fragment reassemble
  [ Evaluations: 114586    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@13 scrub on igc1 inet6 all fragment reassemble
  [ Evaluations: 3         Packets: 3         Bytes: 244         States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@14 scrub on ovpns1 inet all max-mss 1348 fragment reassemble
  [ Evaluations: 7532      Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@15 scrub on ovpns1 inet6 all max-mss 1328 fragment reassemble
  [ Evaluations: 0         Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@16 scrub on ipsec1 inet all fragment reassemble
  [ Evaluations: 24        Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@17 scrub on ipsec1 inet6 all fragment reassemble
  [ Evaluations: 2         Packets: 2         Bytes: 168         States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@18 scrub on ix3.3011 inet all fragment reassemble
  [ Evaluations: 114581    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@19 scrub on ix3.3011 inet6 all fragment reassemble
  [ Evaluations: 0         Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@0 anchor "openvpn/*" all
  [ Evaluations: 2684051   Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@1 anchor "ipsec/*" all
  [ Evaluations: 2684051   Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@2 pass quick on controltun0 all flags S/SA keep state (if-bound) label "descr=Netgate Nexus" ridentifier 1000000011
  [ Evaluations: 2684051   Packets: 4         Bytes: 336         States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@3 pass in quick on lo0 inet6 all flags S/SA keep state label "descr=pass IPv6 loopback" ridentifier 1000000012
  [ Evaluations: 2684048   Packets: 12        Bytes: 1364        States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@4 pass out quick on lo0 inet6 all flags S/SA keep state label "descr=pass IPv6 loopback" ridentifier 1000000013
  [ Evaluations: 13996     Packets: 12        Bytes: 1364        States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@5 block drop in quick inet6 all label "descr=Block all IPv6" ridentifier 1000000014
  [ Evaluations: 2656056   Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@6 block drop out quick inet6 all label "descr=Block all IPv6" ridentifier 1000000015
  [ Evaluations: 1433930   Packets: 3433      Bytes: 526556      States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: Wed Jun 24 11:40:51 2026 ]
@7 block drop in quick inet6 from any to <_nat64reserved_:16> label "descr=Block NAT64 for non-global IPv4" ridentifier 1000000016
  [ Evaluations: 0         Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@8 block drop out quick inet6 from any to <_nat64reserved_:16> label "descr=Block NAT64 for non-global IPv4" ridentifier 1000000017
  [ Evaluations: 0         Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@9 block drop in log quick inet from 169.254.0.0/16 to any label "descr=Block IPv4 link-local" ridentifier 1000000111
  [ Evaluations: 168520    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@10 block drop in log quick inet from any to 169.254.0.0/16 label "descr=Block IPv4 link-local" ridentifier 1000000112
  [ Evaluations: 81254     Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@11 block drop in inet all label "descr=Default deny rule IPv4" label "tags=ruleset:9b232dbde823c279" ridentifier 1000000113
  [ Evaluations: 140       Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@12 block drop out inet all label "descr=Default deny rule IPv4" label "tags=ruleset:9b232dbde823c279" ridentifier 1000000114
  [ Evaluations: 290       Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@13 block drop in inet6 all label "descr=Default deny rule IPv6" label "tags=ruleset:9b232dbde823c279" ridentifier 1000000115
  [ Evaluations: 290       Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@14 block drop out inet6 all label "descr=Default deny rule IPv6" label "tags=ruleset:9b232dbde823c279" ridentifier 1000000116
  [ Evaluations: 150       Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@15 block drop quick inet proto tcp from any port = 0 to any label "descr=Block traffic from port 0" ridentifier 1000000117
  [ Evaluations: 2680603   Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@16 block drop quick inet proto udp from any port = 0 to any label "descr=Block traffic from port 0" ridentifier 1000000117
  [ Evaluations: 2623931   Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@17 block drop quick inet proto tcp from any to any port = 0 label "descr=Block traffic to port 0" ridentifier 1000000118
  [ Evaluations: 2680603   Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@18 block drop quick inet proto udp from any to any port = 0 label "descr=Block traffic to port 0" ridentifier 1000000118
  [ Evaluations: 2623931   Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@19 block drop log quick from <snort2c:0> to any label "descr=Block snort2c hosts" ridentifier 1000000119
  [ Evaluations: 2680603   Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@20 block drop log quick from any to <snort2c:0> label "descr=Block snort2c hosts" ridentifier 1000000120
  [ Evaluations: 2680603   Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@21 block drop in quick proto carp from (self:25) to any label "descr=CARP operation" ridentifier 1000000211
  [ Evaluations: 2680603   Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@22 pass quick proto carp all no state label "descr=CARP operation" ridentifier 1000000212
  [ Evaluations: 2542458   Packets: 2344318   Bytes: 131281808   States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: Wed Jun 24 11:42:35 2026 ]
@23 block drop in quick proto tcp from <sshguard:0> to (self:25) port = ssh label "descr=sshguard" ridentifier 1000000311
  [ Evaluations: 336285    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@24 block drop in quick proto tcp from <sshguard:0> to (self:25) port = https label "descr=GUI Lockout" ridentifier 1000000361
  [ Evaluations: 0         Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@25 block drop in quick from <virusprot:0> to any label "descr=virusprot overload table" ridentifier 1000000400
  [ Evaluations: 138145    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@26 block drop out quick proto udp from any port = bootps to any port = bootpc label "descr=Prevent routing dhcp responses" ridentifier 1000000461 tagged dhcpin
  [ Evaluations: 336285    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@27 pass in quick on ix3 proto udp from any port = bootps to any port = bootpc no state label "descr=allow dhcp replies in WAN" ridentifier 1000000471 tag dhcpin
  [ Evaluations: 138145    Packets: 339       Bytes: 110175      States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@28 pass out quick on ix3 proto udp from any port = bootpc to any port = bootps no state label "descr=allow dhcp client out WAN" ridentifier 1000000472
  [ Evaluations: 170061    Packets: 339       Bytes: 111192      States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@29 block drop in on ! ix3 inet from 172.21.56.0/25 to any label "descr=antispoof protection" ridentifier 1000001481
  [ Evaluations: 335607    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@30 block drop in on ! ix3 inet from 172.21.56.11 to any label "descr=antispoof protection" ridentifier 1000001481
  [ Evaluations: 137647    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@31 block drop in on ix3 inet6 from fe80::92ec:77ff:fe1d:13ea to any label "descr=antispoof protection" ridentifier 1000001481
  [ Evaluations: 321595    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@32 block drop in inet from 172.21.56.51 to any label "descr=antispoof protection" ridentifier 1000001481
  [ Evaluations: 137806    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@33 block drop in inet from 172.21.56.11 to any label "descr=antispoof protection" ridentifier 1000001481
  [ Evaluations: 137806    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@34 block drop in on ! igc0 inet from 192.168.254.0/24 to any label "descr=antispoof protection" ridentifier 1000002531
  [ Evaluations: 137806    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@35 block drop in on ! igc0 inet6 from 2a07:7e84:1000:19a1::/64 to any label "descr=antispoof protection" ridentifier 1000002531
  [ Evaluations: 14149     Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@36 block drop in on ! igc0 inet from 192.168.254.11 to any label "descr=antispoof protection" ridentifier 1000002531
  [ Evaluations: 14128     Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@37 block drop in on igc0 inet6 from fe80::92ec:77ff:fe1d:13ee to any label "descr=antispoof protection" ridentifier 1000002531
  [ Evaluations: 137785    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@38 block drop in inet from 192.168.254.10 to any label "descr=antispoof protection" ridentifier 1000002531
  [ Evaluations: 137806    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@39 block drop in inet6 from 2a07:7e84:1000:19a1:8ac9:b3ff:feb6:1639 to any label "descr=antispoof protection" ridentifier 1000002531
  [ Evaluations: 137806    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@40 block drop in inet from 192.168.254.11 to any label "descr=antispoof protection" ridentifier 1000002531
  [ Evaluations: 137735    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@41 pass in quick on igc0 inet proto udp from any port = bootpc to 255.255.255.255 port = bootps keep state label "descr=allow access to DHCP server" ridentifier 1000002551
  [ Evaluations: 137806    Packets: 36        Bytes: 11964       States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@42 pass in quick on igc0 inet proto udp from any port = bootpc to 192.168.254.10 port = bootps keep state label "descr=allow access to DHCP server" ridentifier 1000002552
  [ Evaluations: 95623     Packets: 132       Bytes: 43296       States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@43 pass out quick on igc0 inet proto udp from 192.168.254.10 port = bootps to any port = bootpc keep state label "descr=allow access to DHCP server" ridentifier 1000002553
  [ Evaluations: 293292    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@44 pass quick on igc0 inet6 proto udp from fe80::/10 to fe80::/10 port = dhcpv6-client keep state label "descr=allow access to DHCPv6 server" ridentifier 1000002561
  [ Evaluations: 95492     Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@45 pass quick on igc0 inet6 proto udp from fe80::/10 to ff02::/16 port = dhcpv6-client keep state label "descr=allow access to DHCPv6 server" ridentifier 1000002562
  [ Evaluations: 0         Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@46 pass quick on igc0 inet6 proto udp from fe80::/10 to ff02::/16 port = dhcpv6-server keep state label "descr=allow access to DHCPv6 server" ridentifier 1000002563
  [ Evaluations: 0         Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@47 pass quick on igc0 inet6 proto udp from ff02::/16 to fe80::/10 port = dhcpv6-server keep state label "descr=allow access to DHCPv6 server" ridentifier 1000002564
  [ Evaluations: 0         Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@48 pass in quick on igc0 inet6 proto udp from fe80::/10 to 2a07:7e84:1000:19a1:8ac9:b3ff:feb6:1639 port = dhcpv6-client keep state label "descr=allow access to DHCPv6 server" ridentifier 1000002565
  [ Evaluations: 0         Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@49 pass out quick on igc0 inet6 proto udp from 2a07:7e84:1000:19a1:8ac9:b3ff:feb6:1639 port = dhcpv6-server to fe80::/10 keep state label "descr=allow access to DHCPv6 server" ridentifier 1000002566
  [ Evaluations: 0         Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@50 block drop in on ! ix2 inet from 192.168.253.0/24 to any label "descr=antispoof protection" ridentifier 1000003581
  [ Evaluations: 335457    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@51 block drop in on ix2 inet6 from fe80::92ec:77ff:fe1d:13eb to any label "descr=antispoof protection" ridentifier 1000003581
  [ Evaluations: 137656    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@52 block drop in inet from 192.168.253.200 to any label "descr=antispoof protection" ridentifier 1000003581
  [ Evaluations: 137656    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@53 block drop in on ! igc1 inet from 192.168.2.0/24 to any label "descr=antispoof protection" ridentifier 1000006731
  [ Evaluations: 137586    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@54 block drop in on igc1 inet6 from fe80::92ec:77ff:fe1d:13ef to any label "descr=antispoof protection" ridentifier 1000006731
  [ Evaluations: 137586    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@55 block drop in inet from 192.168.2.1 to any label "descr=antispoof protection" ridentifier 1000006731
  [ Evaluations: 137586    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@56 pass in quick on igc1 inet proto udp from any port = bootpc to 255.255.255.255 port = bootps keep state label "descr=allow access to DHCP server" ridentifier 1000006751
  [ Evaluations: 137656    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@57 pass in quick on igc1 inet proto udp from any port = bootpc to 192.168.2.1 port = bootps keep state label "descr=allow access to DHCP server" ridentifier 1000006752
  [ Evaluations: 0         Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@58 pass out quick on igc1 inet proto udp from 192.168.2.1 port = bootps to any port = bootpc keep state label "descr=allow access to DHCP server" ridentifier 1000006753
  [ Evaluations: 197801    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@59 block drop in on ! ovpns1 inet from 10.137.0.0/24 to any label "descr=antispoof protection" ridentifier 1000007781
  [ Evaluations: 11360     Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@60 block drop in on ovpns1 inet6 from fe80::92ec:77ff:fe1d:13ee to any label "descr=antispoof protection" ridentifier 1000007781
  [ Evaluations: 4186      Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@61 block drop in inet from 10.137.0.1 to any label "descr=antispoof protection" ridentifier 1000007781
  [ Evaluations: 4186      Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@62 block drop in on ! ipsec1 inet from 10.13.3.4/30 to any label "descr=antispoof protection" ridentifier 1000008831
  [ Evaluations: 35        Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@63 block drop in on ipsec1 inet6 from fe80::92ec:77ff:fe1d:13ee to any label "descr=antispoof protection" ridentifier 1000008831
  [ Evaluations: 35        Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@64 block drop in inet from 10.13.3.7 to any label "descr=antispoof protection" ridentifier 1000008831
  [ Evaluations: 35        Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@65 block drop in on ! ix3.3011 inet from 192.168.30.0/24 to any label "descr=antispoof protection" ridentifier 1000009881
  [ Evaluations: 328085    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@66 block drop in on ix3.3011 inet6 from fe80::92ec:77ff:fe1d:13ea to any label "descr=antispoof protection" ridentifier 1000009881
  [ Evaluations: 137656    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@67 block drop in inet from 192.168.30.12 to any label "descr=antispoof protection" ridentifier 1000009881
  [ Evaluations: 137656    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@68 pass in on lo0 inet all flags S/SA keep state label "descr=pass IPv4 loopback" ridentifier 1000014121
  [ Evaluations: 137656    Packets: 42000     Bytes: 8708926     States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 3     ]
  [ Last Active Time: Wed Jun 24 11:41:29 2026 ]
@69 pass out on lo0 inet all flags S/SA keep state label "descr=pass IPv4 loopback" ridentifier 1000014122
  [ Evaluations: 211791    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@70 pass out inet all flags S/SA keep state allow-opts label "descr=let out anything IPv4 from firewall host itself" ridentifier 1000014123
  [ Evaluations: 321467    Packets: 139702149  Bytes: 127563232032  States: 14    ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 20    ]
  [ Last Active Time: Wed Jun 24 11:42:27 2026 ]
@71 pass out route-to (ix3 172.21.56.1) inet from 172.21.56.51 to ! 172.21.56.0/25 flags S/SA keep state allow-opts label "descr=let out anything from firewall host itself" ridentifier 1000014221
  [ Evaluations: 197801    Packets: 222740    Bytes: 34342791    States: 13    ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 22    ]
  [ Last Active Time: Wed Jun 24 11:42:32 2026 ]
@72 pass out route-to (ix3 172.21.56.1) inet from 172.21.56.11 to ! 172.21.56.0/25 flags S/SA keep state allow-opts label "descr=let out anything from firewall host itself" ridentifier 1000014222
  [ Evaluations: 168158    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@73 pass out route-to (ovpns1 10.137.0.1) inet from 10.137.0.1 to ! 10.137.0.0/24 flags S/SA keep state allow-opts label "descr=let out anything from firewall host itself" ridentifier 1000014223
  [ Evaluations: 7174      Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@74 pass out inet from 10.13.3.7 to ! 10.13.3.4/30 flags S/SA keep state allow-opts label "descr=let out anything from firewall host itself" ridentifier 1000014224
  [ Evaluations: 42        Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@75 pass out on enc0 all flags S/SA keep state label "descr=IPsec internal host to host" ridentifier 1000014522
  [ Evaluations: 30136     Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@76 anchor "userrules/*" all
  [ Evaluations: 335457    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@77 pass in quick on enc0 inet all flags S/SA keep state label "id=1780507862" label "tags=user_rule" ridentifier 1780507862
  [ Evaluations: 50073     Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@78 pass in quick on openvpn inet all flags S/SA keep state label "id=1746703765" label "tags=user_rule" ridentifier 1746703765
  [ Evaluations: 335457    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@79 pass in quick on ix3 reply-to (ix3 172.21.56.1) inet all flags S/SA keep state label "id=1751631963" label "tags=user_rule" label "descr=Allow all ipv4+ipv6 via pfSsh.php" ridentifier 1751631963
  [ Evaluations: 335457    Packets: 4377780   Bytes: 159645989   States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@80 pass in quick on ix3 inet6 all flags S/SA keep state label "id=1751631963" label "tags=user_rule" label "descr=Allow all ipv4+ipv6 via pfSsh.php" ridentifier 1751631963
  [ Evaluations: 41        Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@81 pass in quick on igc0 inet from <LAN__NETWORK:3> to any flags S/SA keep state label "id=0100000101" label "tags=user_rule" label "descr=Default allow LAN to any rule" ridentifier 100000101
  [ Evaluations: 151550    Packets: 135196470  Bytes: 127443919367  States: 23    ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 32    ]
  [ Last Active Time: Wed Jun 24 11:42:35 2026 ]
@82 pass in quick on igc0 inet6 from <LAN__NETWORK:3> to any flags S/SA keep state label "id=0100000102" label "tags=user_rule" label "descr=Default allow LAN IPv6 to any rule" ridentifier 100000102
  [ Evaluations: 537       Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@83 pass in quick on igc1 inet all flags S/SA keep state label "id=1746440189" label "tags=user_rule" ridentifier 1746440189
  [ Evaluations: 28666     Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@84 pass in quick on ix3.3011 inet all flags S/SA keep state label "id=1769615787" label "tags=user_rule" ridentifier 1769615787
  [ Evaluations: 28666     Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@85 pass out inet proto udp from (self:13) to 172.21.56.1 port = isakmp keep state label "descr=IPsec: 172.21.56.1 - outbound isakmp" ridentifier 1000114661
  [ Evaluations: 99        Packets: 2         Bytes: 556         States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@86 pass in on ix3 inet proto udp from 172.21.56.1 to (self:13) port = isakmp keep state label "descr=IPsec: 172.21.56.1 - inbound isakmp" ridentifier 1000114662
  [ Evaluations: 67        Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@87 pass out inet proto udp from (self:13) to 172.21.56.1 port = ipsec-nat-t keep state label "descr=IPsec: 172.21.56.1 - outbound nat-t" ridentifier 1000114663
  [ Evaluations: 78        Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@88 pass in on ix3 inet proto udp from 172.21.56.1 to (self:13) port = ipsec-nat-t keep state label "descr=IPsec: 172.21.56.1 - inbound nat-t" ridentifier 1000114664
  [ Evaluations: 66        Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@89 pass out inet proto esp from (self:13) to 172.21.56.1 keep state label "descr=IPsec: 172.21.56.1 - outbound esp proto" ridentifier 1000114665
  [ Evaluations: 99        Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@90 pass in on ix3 inet proto esp from 172.21.56.1 to (self:13) keep state label "descr=IPsec: 172.21.56.1 - inbound esp proto" ridentifier 1000114666
  [ Evaluations: 6         Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
@91 anchor "tftp-proxy/*" all
  [ Evaluations: 212477    Packets: 0         Bytes: 0           States: 0     ]
  [ Source Nodes: 0      Limit: 0      NAT/RDR: 0      Route: 0      ]
  [ Inserted: uid 0 pid 0 State Creations: 0     ]
  [ Last Active Time: N/A ]
