anchor.diff:      let private combineInOut filters = 
           match filters with
           | (Allow ((Peer s1,lp1),es1) as hd1) :: 
  -          (Allow ((Peer s2,lp2),es2) as hd2) :: 
  -          tl -> 
  -            if ((s1 = "in" && s2 = "out") || (s1 = "out" && s2 = "in")) && 
  -               (lp1 = lp2) && 
  -               (es1 = es2) 
  -            then Allow ((Match.Peer "*",lp1),es1) :: tl
  -            else filters
  +          (Allow ((Peer s2,lp2),es2) as hd2) :: tl -> 
  +            match s1, s2 with 
  +            | In, Out | Out, In -> 
  +                if (lp1 = lp2) && (es1 = es2) then 
  +                    Allow ((Match.Peer Any, lp1),es1) :: tl
  +                else filters
  +            | _, _ -> filters
           | _ -> filters
   
       let minimize filters =
  
positive.code:                 if lp <> 100 then
                      bprintf sb " (LP=%d)" lp
                  for (peer, acts) in es do
                      bprintf sb "\n    Export: [Peer<-%s" peer
                      if acts <> [] then
                          let str = Common.List.joinBy "," (List.map string acts)
                          sb.Append(", " + str) |> ignore
  
negative.code:             else filters
          // no need for explicit deny if we allow everything
          match filters with 
          | [Allow ((Match.Peer Any,_), _)] -> ()
          | _ -> filters <- List.rev (Deny :: filters)
          // build the final configuration
          let deviceConf = 
  