Is there any reason, other than performance, to use this: 100 allow tcp from me to any out via ext0 setup keep-state 200 allow udp from me to any out via ext0 keep-state 300 deny ip from any to any Instead of this: 100 check-state 200 allow tcp from me to any out via ext0 setup keep-state 300 allow udp from me to any out via ext0 keep-state 400 deny ip from any to any