1pass log (user) all flags S/SA keep state 2pass log (all) all flags S/SA keep state 3pass log (to pflog7) all flags S/SA keep state 4block drop log (all, user, to pflog1) all 5block drop log (user, to pflog1) all 6