| block in on eri0 all head 1 | |
| pass in on eri0 proto icmp all group 1 | |
| pass out on ed0 all head 1000000 | |
| block out on ed0 proto udp all group 1000000 | |
| block in on vm0 proto tcp/udp all head 101 | |
| pass in from 1.1.1.1 to 2.2.2.2 group 101 | |
| pass in proto tcp from 1.0.0.1 to 2.0.0.2 group 101 | |
| pass in proto udp from 2.0.0.2 to 3.0.0.3 group 101 | |
| block in on vm0 proto tcp/udp all head vm0-group | |
| pass in from 1.1.1.1 to 2.2.2.2 group vm0-group |