Fallgruber: in, out, on

Hvis du skriver

pass in on $indre from $indre:network to $ytre:network \
     port $porter keep state

trenger du også

pass out on $ytre from $indre:network to $ytre:network \
     port $porter keep state

men mener du egentlig

pass from $indre:network to any port $porter keep state