antispoof:
"this packet should not be here"
drop packets from the wrong network
antispoof for $ext_if antispoof for $int_if
