

# state matches

block in quick inet proto tcp from any to self port = 80

# the same as the one above
block drop in quick inet proto tcp from any to self port = 80

block return in quick inet proto tcp from any to self port = 80
block return in quick inet from any to self
block return in quick inet proto udp from any to self port = 123
block return in quick inet proto icmp from any to self 
block return in quick inet proto { tcp, udp, icmp } from any to self

block return-rst in quick inet proto tcp from any to self port = 80
# incorrect rule (cant ue return-rst with udp). But we import it anyway
block return-rst in quick inet proto udp from any to self port = 123

block return-icmp in quick inet proto tcp from any to self port = 1080
block return-icmp (net-unr) in quick inet proto tcp from any to self port = 1081
block return-icmp (0) in quick inet proto tcp from any to self port = 1082
block return-icmp ( net-unr ) in quick inet proto tcp from any to self port = 1083
block return-icmp ( 0 ) in quick inet proto tcp from any to self port = 1084

block return-icmp (host-unr) in quick inet proto tcp from any to self port = 1085
block return-icmp (1) in quick inet proto tcp from any to self port = 1086

block return-icmp (proto-unr) in quick inet proto tcp from any to self port = 1087
block return-icmp (2) in quick inet proto tcp from any to self port = 1088

block return-icmp (port-unr) in quick inet proto tcp from any to self port = 1089
block return-icmp (3) in quick inet proto tcp from any to self port = 1090

block return-icmp (net-prohib) in quick inet proto tcp from any to self port = 1091
block return-icmp (9) in quick inet proto tcp from any to self port = 1092

block return-icmp (host-prohib) in quick inet proto tcp from any to self port = 1093
block return-icmp (10) in quick inet proto tcp from any to self port = 1094

block return-icmp (filter-prohib) in quick inet proto tcp from any to self port = 1095
block return-icmp (13) in quick inet proto tcp from any to self port = 1096

