why do you bother asking questions if you are not willing to accept answers?
you either need: pass out on bge0 from <inside> block out on bge0 from <inside> to { <outside>, <llcidr> } or: block quick out on bge0 from <inside> to { <outside>, <llcidr> } pass out on bge0 from <inside> alternatively you could have a combined table containing both outside and llcidr sets of addresses, but you can't nest tables so it's probably more work to maintain. the PF faq has something on the subject (tables.html, macros.html). the above post gives you the solutions to this problem, you rejected one of the solutions with because of a feeling, you didn't bother to use the second one (tables) nor to read the given docs :/. -- almir