basic filtering


last match wins

sane defaults, brevity, flexible language

  block
  pass out

stateful by default
since OpenBSD 4.1, explicit "keep state" needed before