jump-to COUNT-NET1 if tcp from net 1.2.3.4/24
accept udp from host 4.3.2.1
reject icmp from any
