On 09/11/2011 19:07, C. Jon Larsen wrote: > put the main portion of the conf in subversion as an include file and > factor out local differences in the configs with macros that are defined in > pf.conf > > Easy. As I said, it's not a pf problem. Commercial firewalls will do all this sort of thing off the shelf. It's a pain to have to write scripts to do this manually. Nick