block in on eri0 all head 1 pass in on eri0 proto icmp all group 1 pass out on ed0 all head 1000000 block out on ed0 proto udp all group 1000000 block in on vm0 proto tcp/udp all head 101 pass in from 1.1.1.1 to 2.2.2.2 group 101 pass in proto tcp from 1.0.0.1 to 2.0.0.2 group 101 pass in proto udp from 2.0.0.2 to 3.0.0.3 group 101 block in on vm0 proto tcp/udp all head vm0-group pass in from 1.1.1.1 to 2.2.2.2 group vm0-group