Thanks for the brief report. I'm sorry my suggestions were not successful.
As I noted above, the match rule is not the same as block or pass. Last matching does not apply, every packet is tested. The pf.conf(5) man page says, "...match rules differ from block and pass rules in that parameters are set every time a packet matches the rule, not only on the last matching rule."
Using pass rather than match may be more helpful for your use case.
|