nat pass on em0 inet from 192.0.2.0/24 to any -> 198.51.100.1
rdr pass on em0 inet proto tcp from any to 198.51.100.1 port = http -> 192.0.2.10
rdr pass log on em0 inet proto tcp from any to 198.51.100.1 port = https -> 192.0.2.10
rdr on em0 inet proto tcp from any to 198.51.100.1 port = ssh -> 192.0.2.10
binat pass on em0 inet from 192.0.2.20 to any -> 198.51.100.20