Prevent floods:
pass inet proto tcp from any to $webserver port www \
flags S/SA keep state \
(max-src-conn-rate 15/5, \
max-src-nodes 250, max-src-states 100, source-track rule)max-src-nodes: number of distinct hosts (IP addresses) allowed to have states
max-src-states: number of states allowed per host
Others simply dropped