playing with matches match in log(matches) from $testbox match in proto tcp to port 2020 rdr-to 127.0.0.5 match in proto tcp to port 2020 rdr-to 127.0.0.4 match in proto tcp to port 2020 rdr-to 127.0.0.3 match in proto tcp to port 2020 rdr-to 127.0.0.2 pass in proto tcp to port 2020 rdr-to 127.0.0.1 port 22 gives same output as the previous ruleset for a packet from $testbox well, rule numbers would be different, nitpickers took me about 1 minute to implement since masturbating monkeys like clean, structured, readable code