1pass in on hme0 proto udp all with not ipopts keep state
2pass in on hme0 proto udp all with ipopts keep state
3pass in on hme0 proto tcp all flags S with opt rr keep state
4pass in on hme0 proto tcp all flags S with opt sec-class secret keep state
5