Early: Replace IPFilter
(almost) IPFilter-compatible config syntax
full-featured filtering with NAT, IPv6
improve performance