anchor on tun1000000 all { anchor "foo" out all { pass proto tcp from any to any port = 1234 flags S/SA anchor proto tcp from any to any port = 2413 user = 0 label "foo" { block drop all pass inet from 127.0.0.1 to any flags S/SA } } pass in proto tcp from any to any port = 1234 flags S/SA }