> /etc/pf.conf: > pass in on rl0 proto udp from any to (rl0) port 137 keep state > > # tcpdump -n -e -ttt -i pflog0: > rule 0/0(match): block in on rl0: 192.168.2.100.137 > > 192.168.2.101.53259: NBT UDP PACKET(137): QUERY; POSITIVE; > RESPONSE; UNICAST Because that came FROM port 137 not TO port 137.