use pfctlinput instead of ip_ctlinput (let everyone see it)