emailserver = "192.0.2.225" pass log proto tcp from any to $emailserver port $email synproxy state pass log proto tcp from $emailserver to any port smtp synproxy state
or log to separate pflog interface
pass log (to pflog1) proto tcp from any to $emailserver port $email pass log (to pflog1) proto tcp from $emailserver to any port smtp