alternative structure: common criteria
anchor "dmz" on $dmz_if { pass out proto { tcp udp } to $nameservers port domain pass out proto tcp to $webservers port { www https } pass out proto tcp to $mailserver port smtp pass in log (all, to pflog1) in proto tcp from $mailserver \ to any port smtp }