anchors named subrulesets can be nested, filesystem-style semantics heavily used by proxies anchor bar from 10/8 { pass to 192.168.42.23 } anchor "ftp-proxy/*" subrulesets inline or loaded later pfctl -a bar -f /etc/pf.bar.conf