In PF, an anchor is a sub-ruleset at a specific point in the filter rules that you can change without reloading the rules. It’s a spot marked “insert rules here,” letting you dynamically add and remove filter rules, tables, and other PF configurations.
The most common users of anchors are software programs. Human beings or sysadmins should probably just edit pf.conf and reload the rules.
OpenBSD includes several programs that take advantage of anchors, however, including the FTP proxy
ftp-proxy(8), the authenticated firewall access system
authpf(8), and the load balancer
relayd(8). You could also use anchors to trigger conditional evaluation of rules.
A ruleset with an anchor might look something like the following, where the interface ...