Policy Filtering example: http://www.openbsd.org/faq/pf/tagging.html

nat-to rule should be match rather than pass else the "enforcement"
rule for outbound lan traffic is redundant.

The rule corresponding to the smtp/pop3 server is omitted from the
full ruleset when the mail_server macro is included.

$ diff -u tagging.html.old tagging.html
--- tagging.html.old    Tue Apr 26 16:38:28 2011
+++ tagging.html        Tue Apr 26 16:43:37 2011
@@ -198,7 +198,7 @@
 <blockquote>
 <tt>
 block all<br>
-pass out on $ext_if tag LAN_INET_NAT tagged LAN_INET nat-to ($ext_if)<br>
+match out on $ext_if tag LAN_INET_NAT tagged LAN_INET nat-to ($ext_if)<br>
 pass in on $int_if from $int_net tag LAN_INET<br>
 pass in on $int_if from $int_net to $dmz_net tag LAN_DMZ<br>
 pass in on $ext_if proto tcp to $www_server port 80 tag INET_DMZ<br>
@@ -255,10 +255,12 @@
 # classification -- classify packets based on the defined firewall
 # policy.
 block all
-pass out on $ext_if tag LAN_INET_NAT tagged LAN_INET nat-to ($ext_if)<br>
+match out on $ext_if tag LAN_INET_NAT tagged LAN_INET nat-to ($ext_if)<br>
 pass in on $int_if from $int_net tag LAN_INET<br>
 pass in on $int_if from $int_net to $dmz_net tag LAN_DMZ<br>
 pass in on $ext_if proto tcp to $www_server port 80 tag INET_DMZ
+pass in on $ext_if proto tcp to $mail_server port { smtp, pop3 } \<br>
+&nbsp;&nbsp;&nbsp;tag INET_DMZ<br>
 pass in on $ext_if proto tcp from &lt;spamd&gt; to port smtp \<br>
 &nbsp;&nbsp;&nbsp;tag SPAMD rdr-to 127.0.0.1 port 8025<br>