Redirection - feeling utterly stupid

I am starting to despair at ever understanding pf redirection/NAT.

I have been trying to build a very simple redirection where
a openbsd firewall running pf sits between the ADSL modem
and a controller.

I have now simplified the pf config to this:
 ------------

ext_if = ¨rl0¨
int_if = ¨xl2¨

controller = ¨172.24.44.89¨

set skip on lo

block log all

pass in log on $int_if
pass out log on $int_if

pass log on $ext_if from $controller to any binat-to $ext_if:0
pass log on $ext_if

 ------------

but it still seems like there is no natting, as packets from the
controller seem to go out with the internal, non-routable address,
so no packets ever get back.