Anything that follows this symbol up to the end of line is ignored. Keys can be defined anywhere, and they are valid until their current scope is effectuated. Within this scope, all key values remain and apply to whatever rule will be the result from the structure. Keys are defined by the valid settings of a firewall. Not surprisingly, they look a lot like the parameters you have to specify when you are using an ordinary kernel firewall program.
Switches exist only in one keyword.
Parameter keys are followed by a value or a value array. Using the option key, you can alter the behaviour of the program in several ways, either cleaning chains before use or be more relaxed about possible problems that could arise from your firewall setup. This will add a rule to the chain input, which is predefined, matching all packets from the tcp protocol, and accepts them. This will insert 4 rules, namely 2 in chain input, and 2 in chain output, matching packets for both udp and tcp, and accepts them. Basically, this is all there is to it, although you can make it quite more complex.