pf's syntax is much easier to reason about than, for instance, iptables. I find myself writing tiny little scripts to emit iptables syntax from something resem

pf's syntax is much easier to reason about than, for instance, iptables. I find myself writing tiny little scripts to emit iptables syntax from something resembling a pythonic-pf, just because I make fewer mistakes when dealing with it.