NAT, both ways


meantime, dst IP changing is mostly fixed

we go back and do a new route lookup if pf sez it changed dst

then pass out without going thru pf again

cannot deliver to a local IP at that point tho