As I stated in
http://www.daemonforums.org/showthre...2948#post21892, unless quick is used, the last matching rule applies.
I notice you have "
block return" in the middle of your ruleset.
This will match all packets. Your prior "pass" rule does not apply.