I'm currently using OpenBSD's packet filter (pf) under FreeBSD 5.4-p1.
 After having problems with Korean botnets, I decided to add several
block rules to deal with them.  One of the rules is: block in quick
from 221.0.0.0/8 to any.  It sits under my "scrub in all" rule.  Down
below the blocks, I have several pass in rules that do some
processing.  One such rule is: pass in quick on $ext_if proto tcp from
<owners> to 1.3.3.7 port 7000 keep state, thus only allowing my IPs
entrance to 1.3.3.7.

Unfortunately, this is blocking someone in 221.0.0.0/8 from legitimate
access to my network.  I need to be able to provide an exception for
them, but only to some IPs and ports.  I would prefer not have to do
multi-line rules to accomplish this.

I can provide a copy of my pf.conf, if needed.  FYI, 1.3.3.7 is used
as a fake IP in this example to protect my privacy.