suggested by naddy@.  This solves the problem that occurs when a
server crashes or is hard booted and comes back up without tearing
down any connections to it, and packets from these connections don't
match any existing state or rule and are silenty dropped.
ok phessler@ henning@ claudio@ dlg@

way, TCP packets of e.g. timed out states are blocked rather than
passed by the implicit default pass rule.
sthen@ benno@ phessler@ mikeb@ agrees

small for production servers now that pf is on by default.
OK phessler@

and filter rules, because we no longer have translation rules.
Pointed out by Mitja Muzenic, ok henning@

for the X protocol instead of port 6000 only; this way pf provides
the same protection level to all X servers.
ok sthen@; "I am convinced that 6000-6010 is acceptable for blocking
in pf" deraadt@, "i'd thought of something similar" oga@

uncomment them.  this is no longer a sample.  everything in here now
must be completely legit.
discussed at length with henning, claudio, and sthen
ok sthen

ok pyr@

- rdr-anchor "relayd/*": the anchor used by relayd to load
redirections into pf.
- pass in on $ext_if proto icmp to ($ext_if): it is a bad habit to
block icmp, this example proposes to allow it by default.
ok henning@

for spamd-setup.  OK beck@

ok henning@

has a rdo on $int_if that stops working then. pt out by cedric

with a set skip statement to the same effect, performs way better
suggested by Stuart Henderson <stu@spacehopper.org>, theo ok

ok cedric@ mcbride@

ok beck@, input from many.

ok mcbride@

requested by deraadt@

ok henning@

ok henning@

ok deraadt@ henning@ frantzen@

ok henning@ dhartmei@

Improved & OK'd by dhartmei@, david@, millert@.

ok henning@

queueing and table examples are from the fosdem2k3 presentation
spamd rdr simplification from henning@
ok dhartmei@ henning@

-correct order
-various spelling/grammar/consistency
from David Krause with feedback from dhartmei@

from sam smith, thx
henning@ ok

ok frantzen@

add more simple filter rule examples
"commit it" deraadt@