Pf Rule

what's wrong with the following? (Besides the half-arsed queueing.)

This is a home router/firewall/NAT machine running OpenBSD. It works fine, but I'm getting periodic log entries about it blocking attempts to connect to TCP port 80 on various sites. And it's legitimate sites that show up in the logs when someone visits them. More confusingly than anything, though, everything works fine despite the log entries.

The logs cite rule 19, which, per pftop, is the following:

19 Block In Log Q dc0 tcp 352 28482 0 return-rst inet all
Where have I gone wrong, and what, exactly, is getting blocked? Again, it's legitimate sites that end users are actually connecting to, not some nefarious thing we've never heard of.

#
int_if = "rl0"
ext_if = "dc0"

# Define a list of IPs that shouldn't ever make it in/out!
nonroute = "{ 192.168.0.0/16, 127.0.0.0/8, 172.16.0.0/12, 10.0.0.0/8, 0.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24, 204.152.64.0/23, 224.0.0.0/3, 255.255.255.255/32 }"

# Defrag incoming packets!
scrub in all

## QUEUE TO GO HERE
##
altq on $ext_if bandwidth 750Kb hfsc queue { ack, game, dns, ssh, bulk }
queue ack bandwidth 75% priority 7 qlimit 500 hfsc (realtime 50%)
queue dns bandwidth 7% priority 6 qlimit 500 hfsc (realtime 5%)
queue game bandwidth 7% priority 6 qlimit 500 hfsc (realtime 5%)
queue ssh bandwidth 5% priority 5 qlimit 500 hfsc (realtime 5%)
queue bulk bandwidth 5% priority 1 qlimit 500 hfsc (realtime 5% default)

# Do NAT
nat on $ext_if from 192.168.1.0/24 to any -> $ext_if

# Skip loopback
pass out quick on lo0 from any to any
pass in quick on lo0 from any to any

# No sense in filtering internal LAN, either
pass out quick on $int_if from any to any
pass in quick on $int_if from any to any

# Block some major crap...
block in log quick on $ext_if inet proto icmp from any to any icmp-type redir

block in quick on $ext_if from $nonroute to any
block out quick on $ext_if from $nonroute to any

## FILTER
# Restrict what ICMP traffic we allow
pass in quick on $ext_if inet proto icmp from any to any icmp-type {
echorep, echoreq, timex, unreach }
block in log quick on $ext_if inet proto icmp from any to any

## TCP
pass in quick on $ext_if inet proto tcp from any to any
flags S/SA keep state

# Let UDP and ICMP out
pass out quick on $ext_if inet proto udp all keep state
pass out quick on $ext_if inet proto icmp from any to any keep state

# Pass out!
pass out quick on $ext_if inet proto tcp from any to any port ssh queue (ssh)
pass out quick on $ext_if inet proto tcp from any to any
flags S/SA keep state queue (ack)
pass out quick on $ext_if inet proto udp all keep state
pass out quick on $ext_if inet proto icmp from any to any keep state

# Now, we block everything else
block return-rst in log quick on $ext_if inet proto tcp from any to any
block return-icmp in log quick on $ext_if inet proto udp from any to any
block in quick on $ext_if all