[pacija]

I use source tracking rules on pf protecting my servers and firewall itself:

https://www.openbsd.org/faq/pf/filter.html#stateopts