Early: Replace IPFilter
(almost) IPFilter-compatible config syntax
full-featured packet filtering with NAT, IPv6
improve performance