usr/sbin/ngctl -f- <<-SEQ
        mkpeer ipfw: bpf 61 ipfw_hook61
        name ipfw:61 bpf_utp_filter
        mkpeer bpf_utp_filter: tag matched tag_utp
        name bpf_utp_filter:matched tag_utp_tagger
SEQ

ngctl msg bpf_utp_filter: setprogram { thisHook=\"ipfw_hook61\" ifNotMatch=\"ipfw_hook61\" ifMatch=\"matched\" bpf_prog_len=12 bpf_prog=[ { code=48 jt=0 jf=0 k=0 } { code=84 jt=0 jf=0 k=240 } { code=21 jt=0 jf=8 k=64 } { code=48 jt=0 jf=0 k=9 } { code=21 jt=0 jf=6 k=17 } { code=40 jt=0 jf=0 k=6 } { code=69 jt=4 jf=0 k=8191 } { code=177 jt=0 jf=0 k=0 } { code=64 jt=0 jf=0 k=20 } { code=21 jt=0 jf=1 k=2147483647 } { code=6 jt=0 jf=0 k=65535 } { code=6 jt=0 jf=0 k=0 } ] }
ngctl msg bpf_utp_filter: setprogram { thisHook=\"matched\" ifMatch=\"ipfw_hook61\" bpf_prog_len=1 bpf_prog=[ { code=6 jt=0 jf=0 k=96 } ] }
ngctl msg tag_utp_tagger: sethookin { thisHook=\"tag_utp\" ifNotMatch=\"tag_utp\" }
ngctl msg tag_utp_tagger: sethookout { thisHook=\"tag_utp\" tag_cookie=1148380143 tag_id=61 }


ipfw add netgraph 61 udp from any to any iplen 0-61
ipfw add deny udp from any to any tagged 0-61

iptables -A FORWARD -p udp -m length --length 61 -m string --hex-string "|7F FF FF FF|" --algo kmp --from 40 --to 44 -j DROP

create access_profile packet_content_mask offset_16-31 0x0 0x000000ff 0x0 0x0 offset_48-63 0x0 0x0000ffff 0xffffff00 0x0 profile 4
config access_profile profile_id 4 add access_id auto_assign packet_content offset 20 0x00000011 offset 52 0x00007fff offset 56 0xffffab00 port 1-28 deny

create access_profile profile_id 2 packet_content_mask offset_chunk_1 9 0xFFFF offset_chunk_2 13 0xFFFF offset_chunk_3 24 0xFFFFFFFF offset_chunk_4 25 0xFF000000
config access_profile profile_id 2 add access_id 1 packet_content offset_chunk_1 0x6A5 offset_chunk_2 0x21 offset_chunk_3 0x7FFFFFFF offset_chunk_4 0xAB000000  port 1:25,2:25 deny