# Sur le reseau 3.0
pass in quick on $iface_dmz3 proto tcp from $srv_client1 to $srv_db1 port $port_mysql tag tag_z3_to_z1 keep state label "client1_dmz1_mysql"
# Sur la cible (1.0)
pass out quick on $iface_dmz1 tagged tag_z3_to_z1 keep state label "tag_z3_to_z1"
block in log quick on $iface_dmz1 label "dmz1_block_in"
block out log quick on $iface_dmz1 label "dmz1_block_out"
99,9% du temps, aucun soucis, sauf, de manière aléatoire :
May 30 15:38:21.499664 rule 46/(match) block in on em3: 192.168.1.1.3306 > 192.168.3.1.33874: [|tcp] (DF)
May 30 15:40:19.897848 rule 46/(match) block in on em3: 192.168.1.1.3306 > 192.168.3.1.36140: [|tcp] (DF)