external interface of a bridge not filtering for itself

[Darrel <Levitch_(_at_)_mac_(_dot_)_com>]

Last spring I installed BSD onto a computer.  Okay, so far.  Now I have 
installed BSD onto five computers.  One of them is a OpenBSD 3.8 bridge on an 
old i386.

The Packet Firewall rules all seemed logical, until I made the firewall; i.e, 
bridge.  Even though filtering is set to take place on the external 
interface, ports 13, 22, 37, and 113 appear in a portscan.  Why is this 
happening?

My ruleset is basic, about like:
set skip on { lo $int_if }
scrub in 
block all
antispoof quick for { lo $int_if }
pass in log quick on $eth_if proto { tcp, udp } from \
<dns> to <this> keep state
pass in log quick on $eth_if inet proto udp from \
<ntp> to <this> port 123 keep state
pass out on $ext_if proto tcp all modulate state flags S/SA
pass out on $ext_if proto { udp, icmp } all keep state

I am considering a change to rc.conf.local:
sshd_flags=NO
inetd=NO
Can I disable inetd?
sshd would be convenient to run, to be connection-abled from the local 
network, but not if the port is viewable from outside.  

Is this typical of bridges?  Cracked computer?  Bad rules?

Darrel