Using 1.2.3-RELEASE here
I use bittorent and was experiencing over a 1000 inetd running :o and I had to reboot every few days :(.
I was using one Port forward NAT entry for TCP and another one for UDP
I have a Firewall rule for TCP and 1 for UDP on the WAN
the /tmp/rules.debug looked like
# NAT Inbound Redirects
rdr on ng0 proto tcp from any to 12.34.56.78 port { 1723 } -> 172.28.15.15
# Reflection redirects
rdr on $lan proto tcp from any to 12.34.56.78 port { 1723 } -> 127.0.0.1 port 19000
rdr on $DMZ proto tcp from any to 12.34.56.78 port { 1723 } -> 127.0.0.1 port 19001
rdr on $WiFi proto tcp from any to 12.34.56.78 port { 1723 } -> 127.0.0.1 port 19002
rdr on ng0 proto udp from any to 12.34.56.78 port { 1723 } -> 172.28.15.15
# Reflection redirects
rdr on $lan proto udp from any to 12.34.56.78 port { 1723 } -> 127.0.0.1 port 19003
rdr on $DMZ proto udp from any to 12.34.56.78 port { 1723 } -> 127.0.0.1 port 19004
rdr on $WiFi proto udp from any to 12.34.56.78 port { 1723 } -> 127.0.0.1 port 19005
# NAT Reflection rules
pass in quick on $lan inet proto tcp from any to $loopback port 19000 keep state label "NAT REFLECT: Allow traffic to localhost"
pass in quick on $DMZ inet proto tcp from any to $loopback port 19001 keep state label "NAT REFLECT: Allow traffic to localhost"
pass in quick on $WiFi inet proto tcp from any to $loopback port 19002 keep state label "NAT REFLECT: Allow traffic to localhost"
pass in quick on $lan inet proto udp from any to $loopback port 19003 keep state label "NAT REFLECT: Allow traffic to localhost"
pass in quick on $DMZ inet proto udp from any to $loopback port 19004 keep state label "NAT REFLECT: Allow traffic to localhost"
pass in quick on $WiFi inet proto udp from any to $loopback port 19005 keep state label "NAT REFLECT: Allow traffic to localhost"
today I changed for a single TCP/UDP Port forward NAT entry and rebooted
I still have a Firewall rule for TCP and 1 for UDP on the WAN
Now I have a steady 46 inetd running after 3 hour uptime ;o)
# NAT Inbound Redirects
rdr on ng0 proto { tcp udp } from any to 12.34.56.78 port { 1723 } -> 172.28.15.15
# Reflection redirects
rdr on $lan proto tcp from any to 12.34.56.78 port { 1723 } -> 127.0.0.1 port 19000
rdr on $lan proto udp from any to 12.34.56.78 port { 1723 } -> 127.0.0.1 port 19001
rdr on $DMZ proto tcp from any to 12.34.56.78 port { 1723 } -> 127.0.0.1 port 19002
rdr on $DMZ proto udp from any to 12.34.56.78 port { 1723 } -> 127.0.0.1 port 19003
rdr on $WiFi proto tcp from any to 12.34.56.78 port { 1723 } -> 127.0.0.1 port 19004
rdr on $WiFi proto udp from any to 12.34.56.78 port { 1723 } -> 127.0.0.1 port 19005
# NAT Reflection rules
pass in quick on $lan inet proto tcp from any to $loopback port 19000 keep state label "NAT REFLECT: Allow traffic to localhost"
pass in quick on $lan inet proto udp from any to $loopback port 19001 keep state label "NAT REFLECT: Allow traffic to localhost"
pass in quick on $DMZ inet proto tcp from any to $loopback port 19002 keep state label "NAT REFLECT: Allow traffic to localhost"
pass in quick on $DMZ inet proto udp from any to $loopback port 19003 keep state label "NAT REFLECT: Allow traffic to localhost"
pass in quick on $WiFi inet proto tcp from any to $loopback port 19004 keep state label "NAT REFLECT: Allow traffic to localhost"
pass in quick on $WiFi inet proto udp from any to $loopback port 19005 keep state label "NAT REFLECT: Allow traffic to localhost"
$WiFi is disabled in both case