1match out on lo0 inet all tag regress nat-to 127.0.0.1 2pass out quick on lo0 all flags S/SA keep state tagged regress 3