>>Thank you for the insight. This mean for me I can't use this approach for
>>the router itself because the IP is dynamic.
>
>You have two choices (well, you probably have more, and probably better 
>than these, but these are the two that I've used):
>
[snip]

why cant you use <http://www.openbsd.org/faq/pf/filter.html> ?
<cite>
The name of a network interface in parentheses ( ). This tells PF to update
the rule if the IP address(es) on the named interface change. This is useful
on an interface that gets its IP address via DHCP or dial-up as the ruleset
doesn't have to be reloaded each time the address changes. 
</cite>

Stephan