1match out on lo0 inet from 192.168.1.1 to any nat-to 10.0.0.1 2match in on lo0 inet proto tcp from any to 1.2.3.4 port = 2222 rdr-to 10.0.0.10 port 22 3match out on lo0 inet from 192.168.1.1 to any nat-to 10.0.0.1 static-port 4match in on lo0 inet from any to 10.0.0.1 rdr-to 192.168.1.1 5pass in on lo1000000 all no state 6