block in on eri0 all head 1
pass in on eri0 proto icmp all group 1
pass out on ed0 all head 1000000
block out on ed0 proto udp all group 1000000
block in on vm0 proto tcp/udp all head 101
pass in from 1.1.1.1 to 2.2.2.2 group 101
pass in proto tcp from 1.0.0.1 to 2.0.0.2 group 101
pass in proto udp from 2.0.0.2 to 3.0.0.3 group 101