i9 revision 145510
1pass in from localhost to localhost with short,frags 2block in from any to any with ipopts 3pass in from any to any with opt nop,rr,zsu 4pass in from any to any with opt nop,rr,zsu not opt ssrr,lsrr 5pass in from localhost to localhost with not frag 6pass in proto tcp all flags S with not oow keep state 7pass in proto tcp all flags S with not bad,bad-src,bad-nat 8