TRANSLATION RULES:
no nat proto carp all
nat-anchor "natearly/*" all
nat-anchor "natrules/*" all
no nat on ix3 inet from 192.168.254.33 to any
nat on ix3 inet from 127.0.0.0/8 to any port = isakmp -> 172.21.56.51 static-port
nat on ix3 inet from 127.0.0.0/8 to any -> 172.21.56.51 port 1024:65535
nat on ix3 inet6 from ::1 to any port = isakmp -> (ix3) round-robin static-port
nat on ix3 inet6 from ::1 to any -> (ix3) port 1024:65535 round-robin
nat on ix3 inet from 192.168.254.0/24 to any port = isakmp -> 172.21.56.51 static-port
nat on ix3 inet from 192.168.253.0/24 to any port = isakmp -> 172.21.56.51 static-port
nat on ix3 inet from 192.168.253.0/24 to any -> 172.21.56.51 port 1024:65535
nat on ix3 inet from 192.168.2.0/24 to any port = isakmp -> 172.21.56.51 static-port
nat on ix3 inet from 192.168.2.0/24 to any -> 172.21.56.51 static-port
nat on ix3 inet from 10.130.0.0/24 to any port = isakmp -> 172.21.56.51 static-port
nat on ix3 inet from 10.130.0.0/24 to any -> 172.21.56.51 port 1024:65535
nat on ix3 inet from 10.130.255.0/24 to any port = isakmp -> 172.21.56.51 static-port
nat on ix3 inet from 10.130.255.0/24 to any -> 172.21.56.51 port 1024:65535
nat on ix3 inet from 10.130.0.0/24 to any port = isakmp -> 172.21.56.51 static-port
nat on ix3 inet from 10.130.0.0/24 to any -> 172.21.56.51 port 1024:65535
nat on ix3 inet from <LAN__NETWORK> to any -> 172.21.56.9 port 1024:65535
nat on ix3 inet from <tonatsubnets> to any port = isakmp -> 172.21.56.51 static-port
nat on ix3 inet6 from <tonatsubnets> to any port = isakmp -> (ix3) round-robin static-port
nat on ix3 inet from <tonatsubnets> to any -> 172.21.56.51 port 1024:65535
nat on ix3 inet6 from <tonatsubnets> to any -> (ix3) port 1024:65535 round-robin
no rdr proto carp all
rdr-anchor "tftp-proxy/*" all

FILTER RULES:
scrub from any to <vpn_networks> max-mss 1300 fragment no reassemble
scrub from <vpn_networks> to any max-mss 1300 fragment no reassemble
scrub on ix3 inet all fragment reassemble
scrub on ix3 inet6 all fragment reassemble
scrub on igc0 inet all fragment reassemble
scrub on igc0 inet6 all fragment reassemble
scrub on ix2 inet all fragment reassemble
scrub on ix2 inet6 all fragment reassemble
scrub on ix0 inet all fragment reassemble
scrub on ix0 inet6 all fragment reassemble
scrub on ix1 inet all fragment reassemble
scrub on ix1 inet6 all fragment reassemble
scrub on igc1 inet all fragment reassemble
scrub on igc1 inet6 all fragment reassemble
scrub on ovpns1 inet all max-mss 1348 fragment reassemble
scrub on ovpns1 inet6 all max-mss 1328 fragment reassemble
scrub on ipsec1 inet all fragment reassemble
scrub on ipsec1 inet6 all fragment reassemble
scrub on ix3.3011 inet all fragment reassemble
scrub on ix3.3011 inet6 all fragment reassemble
anchor "openvpn/*" all
anchor "ipsec/*" all
pass quick on controltun0 all flags S/SA keep state (if-bound) label "descr=Netgate Nexus" ridentifier 1000000011
pass in quick on lo0 inet6 all flags S/SA keep state label "descr=pass IPv6 loopback" ridentifier 1000000012
pass out quick on lo0 inet6 all flags S/SA keep state label "descr=pass IPv6 loopback" ridentifier 1000000013
block drop in quick inet6 all label "descr=Block all IPv6" ridentifier 1000000014
block drop out quick inet6 all label "descr=Block all IPv6" ridentifier 1000000015
block drop in quick inet6 from any to <_nat64reserved_> label "descr=Block NAT64 for non-global IPv4" ridentifier 1000000016
block drop out quick inet6 from any to <_nat64reserved_> label "descr=Block NAT64 for non-global IPv4" ridentifier 1000000017
block drop in log quick inet from 169.254.0.0/16 to any label "descr=Block IPv4 link-local" ridentifier 1000000111
block drop in log quick inet from any to 169.254.0.0/16 label "descr=Block IPv4 link-local" ridentifier 1000000112
block drop in inet all label "descr=Default deny rule IPv4" label "tags=ruleset:9b232dbde823c279" ridentifier 1000000113
block drop out inet all label "descr=Default deny rule IPv4" label "tags=ruleset:9b232dbde823c279" ridentifier 1000000114
block drop in inet6 all label "descr=Default deny rule IPv6" label "tags=ruleset:9b232dbde823c279" ridentifier 1000000115
block drop out inet6 all label "descr=Default deny rule IPv6" label "tags=ruleset:9b232dbde823c279" ridentifier 1000000116
block drop quick inet proto tcp from any port = 0 to any label "descr=Block traffic from port 0" ridentifier 1000000117
block drop quick inet proto udp from any port = 0 to any label "descr=Block traffic from port 0" ridentifier 1000000117
block drop quick inet proto tcp from any to any port = 0 label "descr=Block traffic to port 0" ridentifier 1000000118
block drop quick inet proto udp from any to any port = 0 label "descr=Block traffic to port 0" ridentifier 1000000118
block drop log quick from <snort2c> to any label "descr=Block snort2c hosts" ridentifier 1000000119
block drop log quick from any to <snort2c> label "descr=Block snort2c hosts" ridentifier 1000000120
block drop in quick proto carp from (self) to any label "descr=CARP operation" ridentifier 1000000211
pass quick proto carp all no state label "descr=CARP operation" ridentifier 1000000212
block drop in quick proto tcp from <sshguard> to (self) port = ssh label "descr=sshguard" ridentifier 1000000311
block drop in quick proto tcp from <sshguard> to (self) port = https label "descr=GUI Lockout" ridentifier 1000000361
block drop in quick from <virusprot> to any label "descr=virusprot overload table" ridentifier 1000000400
block drop out quick proto udp from any port = bootps to any port = bootpc label "descr=Prevent routing dhcp responses" ridentifier 1000000461 tagged dhcpin
pass in quick on ix3 proto udp from any port = bootps to any port = bootpc no state label "descr=allow dhcp replies in WAN" ridentifier 1000000471 tag dhcpin
pass out quick on ix3 proto udp from any port = bootpc to any port = bootps no state label "descr=allow dhcp client out WAN" ridentifier 1000000472
block drop in on ! ix3 inet from 172.21.56.0/25 to any label "descr=antispoof protection" ridentifier 1000001481
block drop in on ! ix3 inet from 172.21.56.11 to any label "descr=antispoof protection" ridentifier 1000001481
block drop in on ix3 inet6 from fe80::92ec:77ff:fe1d:13ea to any label "descr=antispoof protection" ridentifier 1000001481
block drop in inet from 172.21.56.51 to any label "descr=antispoof protection" ridentifier 1000001481
block drop in inet from 172.21.56.11 to any label "descr=antispoof protection" ridentifier 1000001481
block drop in on ! igc0 inet from 192.168.254.0/24 to any label "descr=antispoof protection" ridentifier 1000002531
block drop in on ! igc0 inet6 from 2a07:7e84:1000:19a1::/64 to any label "descr=antispoof protection" ridentifier 1000002531
block drop in on ! igc0 inet from 192.168.254.11 to any label "descr=antispoof protection" ridentifier 1000002531
block drop in on igc0 inet6 from fe80::92ec:77ff:fe1d:13ee to any label "descr=antispoof protection" ridentifier 1000002531
block drop in inet from 192.168.254.10 to any label "descr=antispoof protection" ridentifier 1000002531
block drop in inet6 from 2a07:7e84:1000:19a1:8ac9:b3ff:feb6:1639 to any label "descr=antispoof protection" ridentifier 1000002531
block drop in inet from 192.168.254.11 to any label "descr=antispoof protection" ridentifier 1000002531
pass in quick on igc0 inet proto udp from any port = bootpc to 255.255.255.255 port = bootps keep state label "descr=allow access to DHCP server" ridentifier 1000002551
pass in quick on igc0 inet proto udp from any port = bootpc to 192.168.254.10 port = bootps keep state label "descr=allow access to DHCP server" ridentifier 1000002552
pass out quick on igc0 inet proto udp from 192.168.254.10 port = bootps to any port = bootpc keep state label "descr=allow access to DHCP server" ridentifier 1000002553
pass quick on igc0 inet6 proto udp from fe80::/10 to fe80::/10 port = dhcpv6-client keep state label "descr=allow access to DHCPv6 server" ridentifier 1000002561
pass quick on igc0 inet6 proto udp from fe80::/10 to ff02::/16 port = dhcpv6-client keep state label "descr=allow access to DHCPv6 server" ridentifier 1000002562
pass quick on igc0 inet6 proto udp from fe80::/10 to ff02::/16 port = dhcpv6-server keep state label "descr=allow access to DHCPv6 server" ridentifier 1000002563
pass quick on igc0 inet6 proto udp from ff02::/16 to fe80::/10 port = dhcpv6-server keep state label "descr=allow access to DHCPv6 server" ridentifier 1000002564
pass in quick on igc0 inet6 proto udp from fe80::/10 to 2a07:7e84:1000:19a1:8ac9:b3ff:feb6:1639 port = dhcpv6-client keep state label "descr=allow access to DHCPv6 server" ridentifier 1000002565
pass out quick on igc0 inet6 proto udp from 2a07:7e84:1000:19a1:8ac9:b3ff:feb6:1639 port = dhcpv6-server to fe80::/10 keep state label "descr=allow access to DHCPv6 server" ridentifier 1000002566
block drop in on ! ix2 inet from 192.168.253.0/24 to any label "descr=antispoof protection" ridentifier 1000003581
block drop in on ix2 inet6 from fe80::92ec:77ff:fe1d:13eb to any label "descr=antispoof protection" ridentifier 1000003581
block drop in inet from 192.168.253.200 to any label "descr=antispoof protection" ridentifier 1000003581
block drop in on ! igc1 inet from 192.168.2.0/24 to any label "descr=antispoof protection" ridentifier 1000006731
block drop in on igc1 inet6 from fe80::92ec:77ff:fe1d:13ef to any label "descr=antispoof protection" ridentifier 1000006731
block drop in inet from 192.168.2.1 to any label "descr=antispoof protection" ridentifier 1000006731
pass in quick on igc1 inet proto udp from any port = bootpc to 255.255.255.255 port = bootps keep state label "descr=allow access to DHCP server" ridentifier 1000006751
pass in quick on igc1 inet proto udp from any port = bootpc to 192.168.2.1 port = bootps keep state label "descr=allow access to DHCP server" ridentifier 1000006752
pass out quick on igc1 inet proto udp from 192.168.2.1 port = bootps to any port = bootpc keep state label "descr=allow access to DHCP server" ridentifier 1000006753
block drop in on ! ovpns1 inet from 10.137.0.0/24 to any label "descr=antispoof protection" ridentifier 1000007781
block drop in on ovpns1 inet6 from fe80::92ec:77ff:fe1d:13ee to any label "descr=antispoof protection" ridentifier 1000007781
block drop in inet from 10.137.0.1 to any label "descr=antispoof protection" ridentifier 1000007781
block drop in on ! ipsec1 inet from 10.13.3.4/30 to any label "descr=antispoof protection" ridentifier 1000008831
block drop in on ipsec1 inet6 from fe80::92ec:77ff:fe1d:13ee to any label "descr=antispoof protection" ridentifier 1000008831
block drop in inet from 10.13.3.7 to any label "descr=antispoof protection" ridentifier 1000008831
block drop in on ! ix3.3011 inet from 192.168.30.0/24 to any label "descr=antispoof protection" ridentifier 1000009881
block drop in on ix3.3011 inet6 from fe80::92ec:77ff:fe1d:13ea to any label "descr=antispoof protection" ridentifier 1000009881
block drop in inet from 192.168.30.12 to any label "descr=antispoof protection" ridentifier 1000009881
pass in on lo0 inet all flags S/SA keep state label "descr=pass IPv4 loopback" ridentifier 1000014121
pass out on lo0 inet all flags S/SA keep state label "descr=pass IPv4 loopback" ridentifier 1000014122
pass out inet all flags S/SA keep state allow-opts label "descr=let out anything IPv4 from firewall host itself" ridentifier 1000014123
pass out route-to (ix3 172.21.56.1) inet from 172.21.56.51 to ! 172.21.56.0/25 flags S/SA keep state allow-opts label "descr=let out anything from firewall host itself" ridentifier 1000014221
pass out route-to (ix3 172.21.56.1) inet from 172.21.56.11 to ! 172.21.56.0/25 flags S/SA keep state allow-opts label "descr=let out anything from firewall host itself" ridentifier 1000014222
pass out route-to (ovpns1 10.137.0.1) inet from 10.137.0.1 to ! 10.137.0.0/24 flags S/SA keep state allow-opts label "descr=let out anything from firewall host itself" ridentifier 1000014223
pass out inet from 10.13.3.7 to ! 10.13.3.4/30 flags S/SA keep state allow-opts label "descr=let out anything from firewall host itself" ridentifier 1000014224
pass out on enc0 all flags S/SA keep state label "descr=IPsec internal host to host" ridentifier 1000014522
anchor "userrules/*" all
pass in quick on enc0 inet all flags S/SA keep state label "id=1780507862" label "tags=user_rule" ridentifier 1780507862
pass in quick on openvpn inet all flags S/SA keep state label "id=1746703765" label "tags=user_rule" ridentifier 1746703765
pass in quick on ix3 reply-to (ix3 172.21.56.1) inet all flags S/SA keep state label "id=1751631963" label "tags=user_rule" label "descr=Allow all ipv4+ipv6 via pfSsh.php" ridentifier 1751631963
pass in quick on ix3 inet6 all flags S/SA keep state label "id=1751631963" label "tags=user_rule" label "descr=Allow all ipv4+ipv6 via pfSsh.php" ridentifier 1751631963
pass in quick on igc0 inet from <LAN__NETWORK> to any flags S/SA keep state label "id=0100000101" label "tags=user_rule" label "descr=Default allow LAN to any rule" ridentifier 100000101
pass in quick on igc0 inet6 from <LAN__NETWORK> to any flags S/SA keep state label "id=0100000102" label "tags=user_rule" label "descr=Default allow LAN IPv6 to any rule" ridentifier 100000102
pass in quick on igc1 inet all flags S/SA keep state label "id=1746440189" label "tags=user_rule" ridentifier 1746440189
pass in quick on ix3.3011 inet all flags S/SA keep state label "id=1769615787" label "tags=user_rule" ridentifier 1769615787
pass out inet proto udp from (self) to 172.21.56.1 port = isakmp keep state label "descr=IPsec: 172.21.56.1 - outbound isakmp" ridentifier 1000114661
pass in on ix3 inet proto udp from 172.21.56.1 to (self) port = isakmp keep state label "descr=IPsec: 172.21.56.1 - inbound isakmp" ridentifier 1000114662
pass out inet proto udp from (self) to 172.21.56.1 port = ipsec-nat-t keep state label "descr=IPsec: 172.21.56.1 - outbound nat-t" ridentifier 1000114663
pass in on ix3 inet proto udp from 172.21.56.1 to (self) port = ipsec-nat-t keep state label "descr=IPsec: 172.21.56.1 - inbound nat-t" ridentifier 1000114664
pass out inet proto esp from (self) to 172.21.56.1 keep state label "descr=IPsec: 172.21.56.1 - outbound esp proto" ridentifier 1000114665
pass in on ix3 inet proto esp from 172.21.56.1 to (self) keep state label "descr=IPsec: 172.21.56.1 - inbound esp proto" ridentifier 1000114666
anchor "tftp-proxy/*" all
No queue in use

STATES:
all udp 172.21.56.51:42451 -> 10.0.2.15:34946       SINGLE:NO_TRAFFIC
all udp 192.168.254.10:42451 -> 192.168.254.20:34946       SINGLE:NO_TRAFFIC
all udp 172.21.56.51:42451 -> 46.33.222.93:34946       SINGLE:NO_TRAFFIC
all tcp 98.66.133.184:443 <- 192.168.254.20:1929       ESTABLISHED:ESTABLISHED
all tcp 172.21.56.9:24200 (192.168.254.20:1929) -> 98.66.133.184:443       ESTABLISHED:ESTABLISHED
all tcp 98.86.218.21:443 <- 192.168.254.20:2052       ESTABLISHED:ESTABLISHED
all tcp 172.21.56.9:9236 (192.168.254.20:2052) -> 98.86.218.21:443       ESTABLISHED:ESTABLISHED
all tcp 155.133.252.68:443 <- 192.168.254.20:2150       ESTABLISHED:ESTABLISHED
all tcp 172.21.56.9:16971 (192.168.254.20:2150) -> 155.133.252.68:443       ESTABLISHED:ESTABLISHED
all tcp 149.154.167.92:443 <- 192.168.254.20:2201       ESTABLISHED:ESTABLISHED
all tcp 172.21.56.9:2658 (192.168.254.20:2201) -> 149.154.167.92:443       ESTABLISHED:ESTABLISHED
all tcp 203.132.26.94:443 <- 192.168.254.20:2281       ESTABLISHED:ESTABLISHED
all tcp 172.21.56.9:61843 (192.168.254.20:2281) -> 203.132.26.94:443       ESTABLISHED:ESTABLISHED
all tcp 162.159.134.234:443 <- 192.168.254.20:3794       ESTABLISHED:ESTABLISHED
all tcp 172.21.56.9:25083 (192.168.254.20:3794) -> 162.159.134.234:443       ESTABLISHED:ESTABLISHED
all tcp 166.117.116.173:443 <- 192.168.254.20:5372       ESTABLISHED:ESTABLISHED
all tcp 172.21.56.9:47565 (192.168.254.20:5372) -> 166.117.116.173:443       ESTABLISHED:ESTABLISHED
all icmp 172.21.56.51:8 <- 172.21.56.1:63537       0:0
all tcp 44.192.201.198:443 <- 192.168.254.20:6492       ESTABLISHED:ESTABLISHED
all tcp 172.21.56.9:49571 (192.168.254.20:6492) -> 44.192.201.198:443       ESTABLISHED:ESTABLISHED
all tcp 192.168.254.10:443 <- 192.168.254.20:7093       FIN_WAIT_2:FIN_WAIT_2
all tcp 192.168.254.10:443 <- 192.168.254.20:7095       FIN_WAIT_2:FIN_WAIT_2
all tcp 4.176.49.0:443 <- 192.168.254.20:7110       FIN_WAIT_2:FIN_WAIT_2
all tcp 172.21.56.9:38287 (192.168.254.20:7110) -> 4.176.49.0:443       FIN_WAIT_2:FIN_WAIT_2
all tcp 184.33.40.79:80 <- 192.168.254.20:7129       TIME_WAIT:TIME_WAIT
all tcp 172.21.56.9:56113 (192.168.254.20:7129) -> 184.33.40.79:80       TIME_WAIT:TIME_WAIT
all tcp 172.21.56.1:443 <- 192.168.254.20:7132       FIN_WAIT_2:FIN_WAIT_2
all tcp 172.21.56.9:34526 (192.168.254.20:7132) -> 172.21.56.1:443       FIN_WAIT_2:FIN_WAIT_2
all tcp 172.21.56.1:443 <- 192.168.254.20:7137       FIN_WAIT_2:FIN_WAIT_2
all tcp 172.21.56.9:2857 (192.168.254.20:7137) -> 172.21.56.1:443       FIN_WAIT_2:FIN_WAIT_2
all udp 172.21.56.51:500 <- 172.21.56.1:500       MULTIPLE:MULTIPLE
all icmp 172.21.56.51:40945 -> 172.21.56.1:8       0:0
all tcp 4.176.49.0:443 <- 192.168.254.20:7186       ESTABLISHED:ESTABLISHED
all tcp 172.21.56.9:16295 (192.168.254.20:7186) -> 4.176.49.0:443       ESTABLISHED:ESTABLISHED
all udp 216.58.201.238:443 <- 192.168.254.20:58691       MULTIPLE:MULTIPLE
all udp 172.21.56.9:27230 (192.168.254.20:58691) -> 216.58.201.238:443       MULTIPLE:MULTIPLE
all tcp 172.21.56.1:443 <- 192.168.254.20:7197       FIN_WAIT_2:FIN_WAIT_2
all tcp 172.21.56.9:43767 (192.168.254.20:7197) -> 172.21.56.1:443       FIN_WAIT_2:FIN_WAIT_2
all tcp 172.21.56.1:443 <- 192.168.254.20:7198       FIN_WAIT_2:FIN_WAIT_2
all tcp 172.21.56.9:51446 (192.168.254.20:7198) -> 172.21.56.1:443       FIN_WAIT_2:FIN_WAIT_2
all tcp 172.21.56.1:443 <- 192.168.254.20:7200       FIN_WAIT_2:FIN_WAIT_2
all tcp 172.21.56.9:17685 (192.168.254.20:7200) -> 172.21.56.1:443       FIN_WAIT_2:FIN_WAIT_2
all tcp 172.21.56.1:443 <- 192.168.254.20:7201       FIN_WAIT_2:FIN_WAIT_2
all tcp 172.21.56.9:50910 (192.168.254.20:7201) -> 172.21.56.1:443       FIN_WAIT_2:FIN_WAIT_2
all tcp 139.45.207.171:443 <- 192.168.254.20:7202       TIME_WAIT:TIME_WAIT
all tcp 172.21.56.9:8928 (192.168.254.20:7202) -> 139.45.207.171:443       TIME_WAIT:TIME_WAIT
all udp 192.168.254.10:53 <- 192.168.254.20:60247       SINGLE:MULTIPLE
all udp 192.168.254.10:53 <- 192.168.254.20:59917       SINGLE:MULTIPLE
all udp 172.21.56.51:32091 -> 172.21.56.1:53       MULTIPLE:SINGLE
all udp 172.21.56.51:50593 -> 8.8.8.8:53       MULTIPLE:SINGLE
all udp 172.21.56.51:44149 -> 172.21.56.1:53       MULTIPLE:SINGLE
all udp 172.21.56.51:34693 -> 8.8.4.4:53       MULTIPLE:SINGLE
all udp 172.21.56.51:26393 -> 8.8.4.4:53       MULTIPLE:SINGLE
all tcp 143.204.238.16:443 <- 192.168.254.20:7206       FIN_WAIT_2:FIN_WAIT_2
all tcp 172.21.56.9:32497 (192.168.254.20:7206) -> 143.204.238.16:443       FIN_WAIT_2:FIN_WAIT_2
all tcp 172.21.56.1:443 <- 192.168.254.20:7207       FIN_WAIT_2:FIN_WAIT_2
all tcp 172.21.56.9:53911 (192.168.254.20:7207) -> 172.21.56.1:443       FIN_WAIT_2:FIN_WAIT_2
all tcp 172.21.56.1:443 <- 192.168.254.20:7208       ESTABLISHED:ESTABLISHED
all tcp 172.21.56.9:29385 (192.168.254.20:7208) -> 172.21.56.1:443       ESTABLISHED:ESTABLISHED
all tcp 192.168.254.10:443 <- 192.168.254.20:7210       FIN_WAIT_2:FIN_WAIT_2
all tcp 192.168.254.10:443 <- 192.168.254.20:7211       ESTABLISHED:ESTABLISHED
all udp 192.168.254.10:53 <- 192.168.254.20:59149       SINGLE:MULTIPLE
all udp 192.168.254.10:53 <- 192.168.254.20:56673       SINGLE:MULTIPLE
all udp 172.21.56.51:13907 -> 8.8.4.4:53       MULTIPLE:SINGLE
all udp 172.21.56.51:36126 -> 8.8.8.8:53       MULTIPLE:SINGLE
all udp 142.251.143.142:443 <- 192.168.254.20:55387       MULTIPLE:MULTIPLE
all udp 172.21.56.9:21021 (192.168.254.20:55387) -> 142.251.143.142:443       MULTIPLE:MULTIPLE
all tcp 192.168.254.10:443 <- 192.168.254.20:7212       FIN_WAIT_2:FIN_WAIT_2
all tcp 192.168.254.10:443 <- 192.168.254.20:7213       ESTABLISHED:ESTABLISHED
all udp 192.168.254.10:53 <- 192.168.254.20:59067       SINGLE:MULTIPLE
all udp 192.168.254.10:53 <- 192.168.254.20:65190       SINGLE:MULTIPLE
all udp 172.21.56.51:21303 -> 8.8.4.4:53       MULTIPLE:SINGLE
all udp 172.21.56.51:15093 -> 8.8.8.8:53       MULTIPLE:SINGLE
all udp 172.21.56.51:59067 -> 8.8.8.8:53       MULTIPLE:SINGLE
all udp 172.21.56.51:49450 -> 8.8.4.4:53       MULTIPLE:SINGLE
all udp 172.21.56.51:12039 -> 8.8.4.4:53       MULTIPLE:SINGLE
all udp 172.217.19.238:443 <- 192.168.254.20:53047       MULTIPLE:MULTIPLE
all udp 172.21.56.9:24353 (192.168.254.20:53047) -> 172.217.19.238:443       MULTIPLE:MULTIPLE
all udp 172.21.56.51:123 -> 94.140.104.254:123       MULTIPLE:SINGLE
all udp 192.168.254.10:53 <- 192.168.254.20:63913       SINGLE:MULTIPLE
all udp 172.21.56.51:59074 -> 8.8.4.4:53       MULTIPLE:SINGLE
all udp 172.21.56.51:123 -> 195.28.27.26:123       MULTIPLE:SINGLE

INFO:
Status: Enabled for 14 days 03:33:42          Debug: Urgent

Interface Stats for igc0              IPv4             IPv6
  Bytes In                               0                0
  Bytes Out                              0                0
  Packets In
    Passed                        32490826                0
    Blocked                            645                0
  Packets Out
    Passed                       103537869                0
    Blocked                              0             3340

State Table                          Total             Rate
  current entries                       82               
  searches                       283142747          231.6/s
  inserts                           334936            0.3/s
  removals                          334854            0.3/s
Counters
  match                            2684053            2.2/s
  bad-offset                             0            0.0/s
  fragment                               0            0.0/s
  short                                  0            0.0/s
  normalize                              0            0.0/s
  memory                                 0            0.0/s
  bad-timestamp                          0            0.0/s
  congestion                             0            0.0/s
  ip-option                            159            0.0/s
  proto-cksum                            0            0.0/s
  state-mismatch                         0            0.0/s
  state-insert                           0            0.0/s
  state-limit                            0            0.0/s
  src-limit                              0            0.0/s
  synproxy                               0            0.0/s
  map-failed                             0            0.0/s
  translate                              0            0.0/s

LABEL COUNTERS:
descr=Netgate Nexus 2684052 4 336 0 0 4 336 0
descr=pass IPv6 loopback 2684049 12 1364 6 538 6 826 0
descr=pass IPv6 loopback 13996 12 1364 6 826 6 538 0
descr=Block all IPv6 2656057 0 0 0 0 0 0 0
descr=Block all IPv6 1433930 3433 526556 0 0 3433 526556 0
descr=Block NAT64 for non-global IPv4 0 0 0 0 0 0 0 0
descr=Block NAT64 for non-global IPv4 0 0 0 0 0 0 0 0
descr=Block IPv4 link-local 168521 0 0 0 0 0 0 0
descr=Block IPv4 link-local 81255 0 0 0 0 0 0 0
descr=Default deny rule IPv4 tags=ruleset:9b232dbde823c279 141 0 0 0 0 0 0 0
descr=Default deny rule IPv4 tags=ruleset:9b232dbde823c279 291 0 0 0 0 0 0 0
descr=Default deny rule IPv6 tags=ruleset:9b232dbde823c279 291 0 0 0 0 0 0 0
descr=Default deny rule IPv6 tags=ruleset:9b232dbde823c279 150 0 0 0 0 0 0 0
descr=Block traffic from port 0 2680604 0 0 0 0 0 0 0
descr=Block traffic from port 0 2623932 0 0 0 0 0 0 0
descr=Block traffic to port 0 2680604 0 0 0 0 0 0 0
descr=Block traffic to port 0 2623932 0 0 0 0 0 0 0
descr=Block snort2c hosts 2680604 0 0 0 0 0 0 0
descr=Block snort2c hosts 2680604 0 0 0 0 0 0 0
descr=CARP operation 2680604 0 0 0 0 0 0 0
descr=CARP operation 2542459 2344319 131281864 1097972 61486432 1246347 69795432 0
descr=sshguard 336285 0 0 0 0 0 0 0
descr=GUI Lockout 0 0 0 0 0 0 0 0
descr=virusprot overload table 138145 0 0 0 0 0 0 0
descr=Prevent routing dhcp responses 336285 0 0 0 0 0 0 0
descr=allow dhcp replies in WAN 138145 339 110175 339 110175 0 0 0
descr=allow dhcp client out WAN 170061 339 111192 0 0 339 111192 0
descr=antispoof protection 335607 0 0 0 0 0 0 0
descr=antispoof protection 137647 0 0 0 0 0 0 0
descr=antispoof protection 321595 0 0 0 0 0 0 0
descr=antispoof protection 137806 0 0 0 0 0 0 0
descr=antispoof protection 137806 0 0 0 0 0 0 0
descr=antispoof protection 137806 0 0 0 0 0 0 0
descr=antispoof protection 14149 0 0 0 0 0 0 0
descr=antispoof protection 14128 0 0 0 0 0 0 0
descr=antispoof protection 137785 0 0 0 0 0 0 0
descr=antispoof protection 137806 0 0 0 0 0 0 0
descr=antispoof protection 137806 0 0 0 0 0 0 0
descr=antispoof protection 137735 0 0 0 0 0 0 0
descr=allow access to DHCP server 137806 36 11964 36 11964 0 0 0
descr=allow access to DHCP server 95623 132 43296 132 43296 0 0 0
descr=allow access to DHCP server 293292 0 0 0 0 0 0 0
descr=allow access to DHCPv6 server 95492 0 0 0 0 0 0 0
descr=allow access to DHCPv6 server 0 0 0 0 0 0 0 0
descr=allow access to DHCPv6 server 0 0 0 0 0 0 0 0
descr=allow access to DHCPv6 server 0 0 0 0 0 0 0 0
descr=allow access to DHCPv6 server 0 0 0 0 0 0 0 0
descr=allow access to DHCPv6 server 0 0 0 0 0 0 0 0
descr=antispoof protection 335457 0 0 0 0 0 0 0
descr=antispoof protection 137656 0 0 0 0 0 0 0
descr=antispoof protection 137656 0 0 0 0 0 0 0
descr=antispoof protection 137586 0 0 0 0 0 0 0
descr=antispoof protection 137586 0 0 0 0 0 0 0
descr=antispoof protection 137586 0 0 0 0 0 0 0
descr=allow access to DHCP server 137656 0 0 0 0 0 0 0
descr=allow access to DHCP server 0 0 0 0 0 0 0 0
descr=allow access to DHCP server 197801 0 0 0 0 0 0 0
descr=antispoof protection 11360 0 0 0 0 0 0 0
descr=antispoof protection 4186 0 0 0 0 0 0 0
descr=antispoof protection 4186 0 0 0 0 0 0 0
descr=antispoof protection 35 0 0 0 0 0 0 0
descr=antispoof protection 35 0 0 0 0 0 0 0
descr=antispoof protection 35 0 0 0 0 0 0 0
descr=antispoof protection 328085 0 0 0 0 0 0 0
descr=antispoof protection 137656 0 0 0 0 0 0 0
descr=antispoof protection 137656 0 0 0 0 0 0 0
descr=pass IPv4 loopback 137656 42000 8708926 21260 3457923 20740 5251003 3
descr=pass IPv4 loopback 211791 0 0 0 0 0 0 0
descr=let out anything IPv4 from firewall host itself 321467 139702149 127563232032 105021823 124573457154 34680326 2989774878 20
descr=let out anything from firewall host itself 197801 222740 34342791 110726 24339387 112014 10003404 22
descr=let out anything from firewall host itself 168158 0 0 0 0 0 0 0
descr=let out anything from firewall host itself 7174 0 0 0 0 0 0 0
descr=let out anything from firewall host itself 42 0 0 0 0 0 0 0
descr=IPsec internal host to host 30136 0 0 0 0 0 0 0
id=1780507862 tags=user_rule 50073 0 0 0 0 0 0 0
id=1746703765 tags=user_rule 335457 0 0 0 0 0 0 0
id=1751631963 tags=user_rule descr=Allow all ipv4+ipv6 via pfSsh.php 335457 4377780 159645989 2182366 63491213 2195414 96154776 0
id=1751631963 tags=user_rule descr=Allow all ipv4+ipv6 via pfSsh.php 41 0 0 0 0 0 0 0
id=0100000101 tags=user_rule descr=Default allow LAN to any rule 151550 135196470 127443919367 32435408 2926986160 102761062 124516933207 32
id=0100000102 tags=user_rule descr=Default allow LAN IPv6 to any rule 537 0 0 0 0 0 0 0
id=1746440189 tags=user_rule 28666 0 0 0 0 0 0 0
id=1769615787 tags=user_rule 28666 0 0 0 0 0 0 0
descr=IPsec: 172.21.56.1 - outbound isakmp 99 2 556 1 64 1 492 0
descr=IPsec: 172.21.56.1 - inbound isakmp 67 0 0 0 0 0 0 0
descr=IPsec: 172.21.56.1 - outbound nat-t 78 0 0 0 0 0 0 0
descr=IPsec: 172.21.56.1 - inbound nat-t 66 0 0 0 0 0 0 0
descr=IPsec: 172.21.56.1 - outbound esp proto 99 0 0 0 0 0 0 0
descr=IPsec: 172.21.56.1 - inbound esp proto 6 0 0 0 0 0 0 0

TIMEOUTS:
tcp.first                   120s
tcp.opening                  30s
tcp.established           86400s
tcp.closing                 900s
tcp.finwait                  45s
tcp.closed                   90s
tcp.tsdiff                   10s
sctp.first                  120s
sctp.opening                 30s
sctp.established          86400s
sctp.closing                900s
sctp.closed                  90s
udp.first                    60s
udp.single                   30s
udp.multiple                 60s
icmp.first                   20s
icmp.error                   10s
other.first                  60s
other.single                 30s
other.multiple               60s
frag                         60s
interval                     10s
adaptive.start           483000 states
adaptive.end             966000 states
src.track                     0s

LIMITS:
states        hard limit   805000
src-nodes     hard limit   805000
frags         hard limit     5000
table-entries hard limit  2000000
anchors       hard limit      512
eth-anchors   hard limit        0

STATE LIMITERS:
 ID      USE/LIMIT     RATE/SECS     ADMIT  HARDLIM  RATELIM

SOURCE LIMITERS:
 ID      USE/ADDRS    LIMIT  RATE/SECS     ADMIT  ADDRLIM  HARDLIM  RATELIM

TABLES:
ENC0__NETWORK
LAN__NETWORK
OPENVPN__NETWORK
OPT1__NETWORK
OPT2__NETWORK
OPT3__NETWORK
OPT4__NETWORK
OPT5__NETWORK
OPT6__NETWORK
OPT9__NETWORK
TAILSCALE__NETWORK
WAN__NETWORK
WIREGUARD__NETWORK
_nat64reserved_
bogons
snort2c
sshguard
tonatsubnets
virusprot
vpn_networks

OS FINGERPRINTS:
762 fingerprints loaded
