1 pass in on hme0 proto udp all with not ipopts keep state
2 pass in on hme0 proto udp all with ipopts keep state
3 pass in on hme0 proto tcp all flags S with opt rr keep state
4 pass in on hme0 proto tcp all flags S with opt sec-class secret keep state
