1pass in proto tcp from any to any port 123 \ 2 keep state (source-track global, max-src-nodes 1000) 3