my logic tell me it should be pf first then sensei, but based on some observation it looks like the opposite.
just to be sure since I see a strange behavior in sensei filtering and I would like to know it before deeper investigation
Sensei first. It like packet capture where you would also see blocked packets
thanks mimu
then there's maybe some issues with sensei not correctly blocking stuff