match


match is a very substantial change
not one rule deciding on actions, but many

actions are applied on the fly
queue, rtable, set-tos
scrub
log (more on that later)
later nat-to, rdr-to, binat-to

never change pass/block state