Most ACLs (packet filters) don't work with "group" objects where one can list tables of IP addresses and networks for which one rule is applied. OpenBSD's "pf" is the notable exception to this rule. So if you have three email servers and 5 protocols (SMTP, POP3, POP3s, IMAP, and IMAPS), you will need to write 15 rules instead of one, and
not forget a single permutation. With PFconf you only need one rule, and the script will take care of the necessary permutations. These scripts are designed to be fairly simple, leave way room for comments (who ordered that, why is this rule here, etc.), and the usual quartet: small, efficient, portable, and easy to use. The project is no longer actively maintained, but still works.
