Of course you do have 2 sections that do the same thing.
You only really need the antispoof rule.
> >
> > ###############################
> > # SPOOFED ADDRESS BLOCLKS #
> > ##############################
> > spoofed = "{ 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8,
> > 255.255.255.255/32, \
> > 64.90.45.65/26 }"
> >
> >
> > ##################################
> > # Block everything IN by default #
> > ##################################
> > block in all
> > antispoof for $WAN
> >
> >
> > ###########################
> > # DISCARD SPOOFED ATACKS #
> > ###########################
> > block in log quick on $WAN from $spoofed to any
> >
> >
