1match out on lo0 inet from 192.168.1.1 to any tag regress nat-to 10.0.0.1 static-port 2match in on lo0 inet from any to 10.0.0.1 tag regress rdr-to 192.168.1.1 3block drop out on lo0 all tagged regress 4