Today I reworked the pf.conf for some of $dayjob firewalls and I'm pretty happy about the result. Yes I've been a good boy.