> > email server             monowall          cisco adsl
> > 192.168.0.1----192.168.0.254(sis0) / 10.0.0.1(sis1) -- 
10.0.0.254 --internet
> >
> > Incoming connection from rule
> > pass in log quick proto tcp from 192.148.x.x/32 to 192.168.0.1/32 port =
25
> > keep state group 200
> >
> > But email server syn-ack is blocked by sis0
> >
> But these are for different source ports.  Do you have any cases where the
> SYN/ACK is blocked to the *same* port that sent the SYN?

Yes, we have. Two passed entries from internet to lan and one blocked from
lan to internet
sis1 @200:1 p 192.148.x.x,51256 -> 192.168.0.1,25 PR tcp len 20 48 -S K-S IN
sis0 @200:1 p 192.148.x.x,51256 -> 192.168.0.1,25 PR tcp len 20 48 -S K-S
OUT
sis0 @0:17 b 192.168.0.1,25 -> 192.148.x.x,51256 PR tcp len 20 48 -AS IN

The problem is only with incoming mail.

> > Rule 17 is the default rule
> > block in log quick proto tcp from any to any
>
> Yes, and it shouldn't be reached for a packet with a matching state entry.