IPFILTER rules with shell symbloic substitution

[Mike Maltese]

> /etc/rc.firewall has lots of examples using ipfw; the concepts should
> work just as well with ipf.

I'm not sure that's true. /etc/rc.firewall is a shell script, an IP Filter
ruleset isn't. From the documentation and my own use of it, IP Filter
doesn't support variable substitution. If you're running 5.x, you can run
the pf port, which does support variables and some other neat expansion
capabilities that can really condense and simplify your ruleset.