routed ipv4&6 and firewalling with pf

Hello misc@,

WIth a new FTTP connection, I have to use pppoe and a static route for
ipv4. Thse are real routable IPs.

In this example, let's say the connection IP (the one pppoe gets) is
198.51.100.2/32. It gets this on authentication, probably radius/l2tp 
on the isp side. 

The static route I need to implement is 203.0.113.0/28.
I presume 203.0.113.0/28 will be on the dmz interface not the wan.

Is a pf configuration possible where 198.51.100.2/32 is filtered (let's say
it allows ssh access only) but 203.0.113.0/28 is not?

On FreeBSD pf I'd find the MAC addresses of all the interfaces on all machines
in the dmz then have the following:

~~~~~~~~~~~~~~
# tagging macro
ALLOWED_MAC = "put-mac-addresses-here"

# pass rules
pass quick on $ext_if tagged ALLOWED_MAC
~~~~~~~~~~~~~

As I understand it, OpenBSD pf does not have layer 2 functionality.
Is this understanding still correct?

If it is, how do I spare 203.0.113.0/28 from being processed by pf?

thanks in advance for any advice
--