design basics


last match wins

sane defaults, brevity, flexible language

stateful
by default since OpenBSD 4.1
explicit "keep state" needed before