Update: some web pages just don't load, clients behind the firewall cannot even connect to those particular servers (www.iwiw.hu for example). Tcpdump shows nothing, when we disable pf, they load.