diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h
--- a/sys/net/pfvar.h
+++ b/sys/net/pfvar.h
@@ -1155,7 +1155,6 @@
 	int			 rewrite;
 	u_short			 reason;
 	struct pf_src_node	*sns[PF_SN_MAX];
-	struct pf_krule_slist	 rules;
 	struct pf_krule		*nr;
 	struct pf_krule		*tr;
 	struct pf_krule		**rm;
@@ -2666,8 +2665,10 @@
 #ifdef _KERNEL
 void			 pf_print_host(struct pf_addr *, u_int16_t, sa_family_t);
 
-enum pf_test_status	 pf_step_into_anchor(struct pf_test_ctx *, struct pf_krule *);
-enum pf_test_status	 pf_match_rule(struct pf_test_ctx *, struct pf_kruleset *);
+enum pf_test_status	 pf_step_into_anchor(struct pf_test_ctx *, struct pf_krule *,
+			    struct pf_krule_slist *match_rules);
+enum pf_test_status	 pf_match_rule(struct pf_test_ctx *, struct pf_kruleset *,
+			    struct pf_krule_slist *);
 void			 pf_step_into_keth_anchor(struct pf_keth_anchor_stackframe *,
 			    int *, struct pf_keth_ruleset **,
 			    struct pf_keth_rule **, struct pf_keth_rule **,
diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -344,10 +344,12 @@
 			    struct mbuf **);
 static int		 pf_test_rule(struct pf_krule **, struct pf_kstate **,
 			    struct pf_pdesc *, struct pf_krule **,
-			    struct pf_kruleset **, u_short *, struct inpcb *);
+			    struct pf_kruleset **, u_short *, struct inpcb *,
+			    struct pf_krule_slist *);
 static int		 pf_create_state(struct pf_krule *,
 			    struct pf_test_ctx *,
-			    struct pf_kstate **, u_int16_t, u_int16_t);
+			    struct pf_kstate **, u_int16_t, u_int16_t,
+			    struct pf_krule_slist *match_rules);
 static int		 pf_state_key_addr_setup(struct pf_pdesc *,
 			    struct pf_state_key_cmp *, int);
 static int		 pf_tcp_track_full(struct pf_kstate *,
@@ -393,7 +395,7 @@
 static int		 pf_match_rcvif(struct mbuf *, struct pf_krule *);
 static void		 pf_counters_inc(int, struct pf_pdesc *,
 			    struct pf_kstate *, struct pf_krule *,
-			    struct pf_krule *);
+			    struct pf_krule *, struct pf_krule_slist *);
 static void		 pf_log_matches(struct pf_pdesc *, struct pf_krule *,
 			    struct pf_krule *, struct pf_kruleset *,
 			    struct pf_krule_slist *);
@@ -489,26 +491,30 @@
 			counter_u64_add(s->anchor->states_cur, 1);	\
 			counter_u64_add(s->anchor->states_tot, 1);	\
 		}							\
-		if (s->nat_rule != NULL) {				\
-			counter_u64_add(s->nat_rule->states_cur, 1);\
-			counter_u64_add(s->nat_rule->states_tot, 1);\
+		if (s->nat_rule != NULL && s->nat_rule != s->rule) {	\
+			counter_u64_add(s->nat_rule->states_cur, 1);	\
+			counter_u64_add(s->nat_rule->states_tot, 1);	\
 		}							\
 		SLIST_FOREACH(mrm, &s->match_rules, entry) {		\
-			counter_u64_add(mrm->r->states_cur, 1);		\
-			counter_u64_add(mrm->r->states_tot, 1);		\
+			if (s->nat_rule != mrm->r) {			\
+				counter_u64_add(mrm->r->states_cur, 1);	\
+				counter_u64_add(mrm->r->states_tot, 1);	\
+			}						\
 		}							\
 	} while (0)
 
 #define	STATE_DEC_COUNTERS(s)						\
 	do {								\
 		struct pf_krule_item *mrm;				\
-		if (s->nat_rule != NULL)				\
-			counter_u64_add(s->nat_rule->states_cur, -1);\
-		if (s->anchor != NULL)				\
-			counter_u64_add(s->anchor->states_cur, -1);	\
 		counter_u64_add(s->rule->states_cur, -1);		\
+		if (s->anchor != NULL)					\
+			counter_u64_add(s->anchor->states_cur, -1);	\
+		if (s->nat_rule != NULL && s->nat_rule != s->rule)	\
+			counter_u64_add(s->nat_rule->states_cur, -1);	\
 		SLIST_FOREACH(mrm, &s->match_rules, entry)		\
-			counter_u64_add(mrm->r->states_cur, -1);	\
+			if (s->nat_rule != mrm->r) {			\
+				counter_u64_add(mrm->r->states_cur, -1);\
+			}						\
 	} while (0)
 
 MALLOC_DEFINE(M_PFHASH, "pf_hash", "pf(4) hash header structures");
@@ -2869,20 +2875,24 @@
 	return (uma_zalloc(V_pf_state_z, flags | M_ZERO));
 }
 
+static __inline void
+pf_free_match_rules(struct pf_krule_slist *match_rules) {
+	struct pf_krule_item	*ri;
+
+	while ((ri = SLIST_FIRST(match_rules))) {
+		SLIST_REMOVE_HEAD(match_rules, entry);
+		free(ri, M_PF_RULE_ITEM);
+	}
+}
+
 void
 pf_free_state(struct pf_kstate *cur)
 {
-	struct pf_krule_item *ri;
-
 	KASSERT(cur->refs == 0, ("%s: %p has refs", __func__, cur));
 	KASSERT(cur->timeout == PFTM_UNLINKED, ("%s: timeout %u", __func__,
 	    cur->timeout));
 
-	while ((ri = SLIST_FIRST(&cur->match_rules))) {
-		SLIST_REMOVE_HEAD(&cur->match_rules, entry);
-		free(ri, M_PF_RULE_ITEM);
-	}
-
+	pf_free_match_rules(&(cur->match_rules));
 	pf_normalize_tcp_cleanup(cur);
 	uma_zfree(V_pf_state_z, cur);
 	pf_counter_u64_add(&V_pf_status.fcounters[FCNT_STATE_REMOVALS], 1);
@@ -4733,7 +4743,8 @@
 } while (0)
 
 enum pf_test_status
-pf_step_into_anchor(struct pf_test_ctx *ctx, struct pf_krule *r)
+pf_step_into_anchor(struct pf_test_ctx *ctx, struct pf_krule *r,
+    struct pf_krule_slist *match_rules)
 {
 	enum pf_test_status	rv;
 
@@ -4751,7 +4762,7 @@
 		struct pf_kanchor *child;
 		rv = PF_TEST_OK;
 		RB_FOREACH(child, pf_kanchor_node, &r->anchor->children) {
-			rv = pf_match_rule(ctx, &child->ruleset);
+			rv = pf_match_rule(ctx, &child->ruleset, match_rules);
 			if ((rv == PF_TEST_QUICK) || (rv == PF_TEST_FAIL)) {
 				/*
 				 * we either hit a rule with quick action
@@ -4762,7 +4773,7 @@
 			}
 		}
 	} else {
-		rv = pf_match_rule(ctx, &r->anchor->ruleset);
+		rv = pf_match_rule(ctx, &r->anchor->ruleset, match_rules);
 		/*
 		 * Unless errors occured, stop iff any rule matched
 		 * within quick anchors.
@@ -5611,9 +5622,10 @@
 }
 
 enum pf_test_status
-pf_match_rule(struct pf_test_ctx *ctx, struct pf_kruleset *ruleset)
+pf_match_rule(struct pf_test_ctx *ctx, struct pf_kruleset *ruleset,
+    struct pf_krule_slist *match_rules)
 {
-	struct pf_krule_item	*ri;
+	struct pf_krule_item	*ri, *rt;
 	struct pf_krule		*r;
 	struct pf_krule		*save_a;
 	struct pf_kruleset	*save_aruleset;
@@ -5752,11 +5764,15 @@
 					return (PF_TEST_FAIL);
 				}
 				ri->r = r;
-				SLIST_INSERT_HEAD(&ctx->rules, ri, entry);
-				pf_counter_u64_critical_enter();
-				pf_counter_u64_add_protected(&r->packets[pd->dir == PF_OUT], 1);
-				pf_counter_u64_add_protected(&r->bytes[pd->dir == PF_OUT], pd->tot_len);
-				pf_counter_u64_critical_exit();
+
+				if (SLIST_EMPTY(match_rules)) {
+					SLIST_INSERT_HEAD(match_rules, ri, entry);
+					rt = ri;
+				} else {
+					SLIST_INSERT_AFTER(rt, ri, entry);
+					rt = ri;
+				}
+
 				pf_rule_to_actions(r, &pd->act);
 				if (r->log)
 					PFLOG_PACKET(r->action, PFRES_MATCH, r,
@@ -5780,7 +5796,7 @@
 				ctx->arsm = ctx->aruleset;
 			}
 			if (pd->act.log & PF_LOG_MATCHES)
-				pf_log_matches(pd, r, ctx->a, ruleset, &ctx->rules);
+				pf_log_matches(pd, r, ctx->a, ruleset, match_rules);
 			if (r->quick) {
 				ctx->test_status = PF_TEST_QUICK;
 				break;
@@ -5797,7 +5813,7 @@
 			 * Note: we don't need to restore if we are not going
 			 * to continue with ruleset evaluation.
 			 */
-			if (pf_step_into_anchor(ctx, r) != PF_TEST_OK) {
+			if (pf_step_into_anchor(ctx, r, match_rules) != PF_TEST_OK) {
 				break;
 			}
 			ctx->a = save_a;
@@ -5812,11 +5828,11 @@
 static int
 pf_test_rule(struct pf_krule **rm, struct pf_kstate **sm,
     struct pf_pdesc *pd, struct pf_krule **am,
-    struct pf_kruleset **rsm, u_short *reason, struct inpcb *inp)
+    struct pf_kruleset **rsm, u_short *reason, struct inpcb *inp,
+    struct pf_krule_slist *match_rules)
 {
 	struct pf_krule		*r = NULL;
 	struct pf_kruleset	*ruleset = NULL;
-	struct pf_krule_item	*ri;
 	struct pf_test_ctx	 ctx;
 	u_short			 transerror;
 	int			 action = PF_PASS;
@@ -5833,7 +5849,6 @@
 	ctx.rsm = rsm;
 	ctx.th = &pd->hdr.tcp;
 	ctx.reason = *reason;
-	SLIST_INIT(&ctx.rules);
 
 	pf_addrcpy(&pd->nsaddr, pd->src, pd->af);
 	pf_addrcpy(&pd->ndaddr, pd->dst, pd->af);
@@ -5926,7 +5941,7 @@
 	}
 
 	ruleset = &pf_main_ruleset;
-	rv = pf_match_rule(&ctx, ruleset);
+	rv = pf_match_rule(&ctx, ruleset, match_rules);
 	if (rv == PF_TEST_FAIL) {
 		/*
 		 * Reason has been set in pf_match_rule() already.
@@ -5962,7 +5977,7 @@
 		PFLOG_PACKET(r->action, ctx.reason, r, ctx.a, ruleset, pd, 1, NULL);
 	}
 	if (pd->act.log & PF_LOG_MATCHES)
-		pf_log_matches(pd, r, ctx.a, ruleset, &ctx.rules);
+		pf_log_matches(pd, r, ctx.a, ruleset, match_rules);
 	if (pd->virtual_proto != PF_VPROTO_FRAGMENT &&
 	   (r->action == PF_DROP) &&
 	    ((r->rule_flag & PFRULE_RETURNRST) ||
@@ -6007,7 +6022,8 @@
 	    (pd->flags & PFDESC_TCP_NORM)))) {
 		bool nat64;
 
-		action = pf_create_state(r, &ctx, sm, bproto_sum, bip_sum);
+		action = pf_create_state(r, &ctx, sm, bproto_sum, bip_sum,
+		    match_rules);
 		ctx.sk = ctx.nk = NULL;
 		if (action != PF_PASS) {
 			pf_udp_mapping_release(ctx.udp_mapping);
@@ -6053,11 +6069,6 @@
 				action = PF_AFRT;
 		}
 	} else {
-		while ((ri = SLIST_FIRST(&ctx.rules))) {
-			SLIST_REMOVE_HEAD(&ctx.rules, entry);
-			free(ri, M_PF_RULE_ITEM);
-		}
-
 		uma_zfree(V_pf_state_key_z, ctx.sk);
 		uma_zfree(V_pf_state_key_z, ctx.nk);
 		ctx.sk = ctx.nk = NULL;
@@ -6085,11 +6096,6 @@
 	return (action);
 
 cleanup:
-	while ((ri = SLIST_FIRST(&ctx.rules))) {
-		SLIST_REMOVE_HEAD(&ctx.rules, entry);
-		free(ri, M_PF_RULE_ITEM);
-	}
-
 	uma_zfree(V_pf_state_key_z, ctx.sk);
 	uma_zfree(V_pf_state_key_z, ctx.nk);
 	pf_udp_mapping_release(ctx.udp_mapping);
@@ -6100,7 +6106,8 @@
 
 static int
 pf_create_state(struct pf_krule *r, struct pf_test_ctx *ctx,
-    struct pf_kstate **sm, u_int16_t bproto_sum, u_int16_t bip_sum)
+    struct pf_kstate **sm, u_int16_t bproto_sum, u_int16_t bip_sum,
+    struct pf_krule_slist *match_rules)
 {
 	struct pf_pdesc		*pd = ctx->pd;
 	struct pf_kstate	*s = NULL;
@@ -6114,7 +6121,6 @@
 	struct tcphdr		*th = &pd->hdr.tcp;
 	u_int16_t		 mss = V_tcp_mssdflt;
 	u_short			 sn_reason;
-	struct pf_krule_item	*ri;
 
 	/* check maximums */
 	if (r->max_states &&
@@ -6166,7 +6172,7 @@
 	s->rule = r;
 	s->nat_rule = ctx->nr;
 	s->anchor = ctx->a;
-	memcpy(&s->match_rules, &ctx->rules, sizeof(s->match_rules));
+	s->match_rules = *match_rules;
 	memcpy(&s->act, &pd->act, sizeof(struct pf_rule_actions));
 
 	if (pd->act.allow_opts)
@@ -6330,11 +6336,6 @@
 	return (PF_PASS);
 
 csfailed:
-	while ((ri = SLIST_FIRST(&ctx->rules))) {
-		SLIST_REMOVE_HEAD(&ctx->rules, entry);
-		free(ri, M_PF_RULE_ITEM);
-	}
-
 	uma_zfree(V_pf_state_key_z, ctx->sk);
 	uma_zfree(V_pf_state_key_z, ctx->nk);
 
@@ -7484,6 +7485,7 @@
 pf_sctp_multihome_delayed(struct pf_pdesc *pd, struct pfi_kkif *kif,
     struct pf_kstate *s, int action)
 {
+	struct pf_krule_slist		 match_rules;
 	struct pf_sctp_multihome_job	*j, *tmp;
 	struct pf_sctp_source		*i;
 	int			 ret;
@@ -7531,8 +7533,14 @@
 			if (s->rule->rule_flag & PFRULE_ALLOW_RELATED) {
 				j->pd.related_rule = s->rule;
 			}
+			SLIST_INIT(&match_rules);
 			ret = pf_test_rule(&r, &sm,
-			    &j->pd, &ra, &rs, &reason, NULL);
+			    &j->pd, &ra, &rs, &reason, NULL, &match_rules);
+			/*
+			 * Nothing to do about match rules, the processed
+			 * packet has already increased the counters.
+			 */
+			pf_free_match_rules(&match_rules);
 			PF_RULES_RUNLOCK();
 			SDT_PROBE4(pf, sctp, multihome, test, kif, r, j->pd.m, ret);
 			if (ret != PF_DROP && sm != NULL) {
@@ -10614,108 +10622,149 @@
 	return (0);
 }
 
-static void
-pf_counters_inc(int action, struct pf_pdesc *pd,
-    struct pf_kstate *s, struct pf_krule *r, struct pf_krule *a)
+static __inline void
+pf_rule_counters_inc(struct pf_pdesc *pd, struct pf_krule *r, int dir_out,
+    int op_pass, sa_family_t af, struct pf_addr *src_host,
+    struct pf_addr *dst_host)
 {
-	struct pf_krule		*tr;
-	int			 dir = pd->dir;
-	int			 dirndx;
+	pf_counter_u64_add_protected(&(r->packets[dir_out]), 1);
+	pf_counter_u64_add_protected(&(r->bytes[dir_out]), pd->tot_len);
+	pf_update_timestamp(r);
+
+	if (r->src.addr.type == PF_ADDR_TABLE)
+		pfr_update_stats(r->src.addr.p.tbl, src_host, af,
+		    pd->tot_len, dir_out, op_pass, r->src.neg);
+	if (r->dst.addr.type == PF_ADDR_TABLE)
+		pfr_update_stats(r->dst.addr.p.tbl, dst_host, af,
+		    pd->tot_len, dir_out, op_pass, r->dst.neg);
+}
+
+static void
+pf_counters_inc(int action, struct pf_pdesc *pd, struct pf_kstate *s,
+    struct pf_krule *r, struct pf_krule *a, struct pf_krule_slist *match_rules)
+{
+	struct pf_krule_slist	*mr = match_rules;
+	struct pf_krule_item	*ri;
+	struct pf_krule		*nr = NULL;
+	struct pf_addr		*src_host = pd->src;
+	struct pf_addr		*dst_host = pd->dst;
+	struct pf_state_key	*key;
+	int			 dir_out = (pd->dir == PF_OUT);
+	int			 op_pass = (r->action == PF_PASS);
+	sa_family_t		 af = pd->af;
+	int			 s_dir_in, s_dir_out, s_dir_rev;
 
 	pf_counter_u64_critical_enter();
+
 	pf_counter_u64_add_protected(
-	    &pd->kif->pfik_bytes[pd->af == AF_INET6][dir == PF_OUT][action != PF_PASS],
+	    &pd->kif->pfik_bytes[pd->af == AF_INET6][dir_out][action != PF_PASS],
 	    pd->tot_len);
 	pf_counter_u64_add_protected(
-	    &pd->kif->pfik_packets[pd->af == AF_INET6][dir == PF_OUT][action != PF_PASS],
+	    &pd->kif->pfik_packets[pd->af == AF_INET6][dir_out][action != PF_PASS],
 	    1);
 
-	if (action == PF_PASS || action == PF_AFRT || r->action == PF_DROP) {
-		dirndx = (dir == PF_OUT);
-		pf_counter_u64_add_protected(&r->packets[dirndx], 1);
-		pf_counter_u64_add_protected(&r->bytes[dirndx], pd->tot_len);
-		pf_update_timestamp(r);
+	/* If the rule has failed to apply, don't increase its counters */
+	if (!(action == PF_PASS || action == PF_AFRT || r->action == PF_DROP)) {
+		pf_counter_u64_critical_exit();
+		return;
+	}
 
-		if (a != NULL) {
-			pf_counter_u64_add_protected(&a->packets[dirndx], 1);
-			pf_counter_u64_add_protected(&a->bytes[dirndx], pd->tot_len);
+	if (s != NULL) {
+		PF_STATE_LOCK_ASSERT(s);
+		mr = &(s->match_rules);
+
+		/*
+		 * For af-to on the inbound direction we can determine
+		 * the direction only by checking direction of AF translation,
+		 * since the state is always "in" and so is packet's direction.
+		 */
+		if (pd->af != pd->naf && s->direction == PF_IN) {
+			dir_out = (pd->naf == s->rule->naf);
+			s_dir_in = 1;
+			s_dir_out = 0;
+			s_dir_rev = (pd->naf != s->rule->naf);
+		}
+		else {
+			dir_out = (pd->dir == PF_OUT);
+			s_dir_in = (s->direction == PF_IN);
+			s_dir_out = (s->direction == PF_OUT);
+			s_dir_rev = (pd->dir != s->direction);
 		}
-		if (s != NULL) {
-			struct pf_krule_item	*ri;
 
-			if (s->nat_rule != NULL) {
-				pf_counter_u64_add_protected(&s->nat_rule->packets[dirndx],
+		s->packets[s_dir_rev]++;
+		s->bytes[s_dir_rev] += pd->tot_len;
+
+		/*
+		 * Source nodes are accessed unlocked here. But since we are
+		 * operating with stateful tracking and the state is locked,
+		 * those SNs could not have been freed.
+		 */
+		for (pf_sn_types_t sn_type=0; sn_type<PF_SN_MAX; sn_type++) {
+			if (s->sns[sn_type] != NULL) {
+				counter_u64_add(
+				    s->sns[sn_type]->packets[dir_out],
 				    1);
-				pf_counter_u64_add_protected(&s->nat_rule->bytes[dirndx],
+				counter_u64_add(
+				    s->sns[sn_type]->bytes[dir_out],
 				    pd->tot_len);
 			}
-			/*
-			 * Source nodes are accessed unlocked here.
-			 * But since we are operating with stateful tracking
-			 * and the state is locked, those SNs could not have
-			 * been freed.
-			 */
-			for (pf_sn_types_t sn_type=0; sn_type<PF_SN_MAX; sn_type++) {
-				if (s->sns[sn_type] != NULL) {
-					counter_u64_add(
-					    s->sns[sn_type]->packets[dirndx],
-					    1);
-					counter_u64_add(
-					    s->sns[sn_type]->bytes[dirndx],
-					    pd->tot_len);
-				}
-			}
-			dirndx = (dir == s->direction) ? 0 : 1;
-			s->packets[dirndx]++;
-			s->bytes[dirndx] += pd->tot_len;
-
-			SLIST_FOREACH(ri, &s->match_rules, entry) {
-				pf_counter_u64_add_protected(&ri->r->packets[dirndx], 1);
-				pf_counter_u64_add_protected(&ri->r->bytes[dirndx], pd->tot_len);
-
-				if (ri->r->src.addr.type == PF_ADDR_TABLE)
-					pfr_update_stats(ri->r->src.addr.p.tbl,
-					    (s == NULL) ? pd->src :
-					    &s->key[(s->direction == PF_IN)]->
-						addr[(s->direction == PF_OUT)],
-					    pd->af, pd->tot_len, dir == PF_OUT,
-					    r->action == PF_PASS, ri->r->src.neg);
-				if (ri->r->dst.addr.type == PF_ADDR_TABLE)
-					pfr_update_stats(ri->r->dst.addr.p.tbl,
-					    (s == NULL) ? pd->dst :
-					    &s->key[(s->direction == PF_IN)]->
-						addr[(s->direction == PF_IN)],
-					    pd->af, pd->tot_len, dir == PF_OUT,
-					    r->action == PF_PASS, ri->r->dst.neg);
-			}
 		}
 
-		tr = r;
-		if (s != NULL && s->nat_rule != NULL &&
-		    r == &V_pf_default_rule)
-			tr = s->nat_rule;
-
-		if (tr->src.addr.type == PF_ADDR_TABLE)
-			pfr_update_stats(tr->src.addr.p.tbl,
-			    (s == NULL) ? pd->src :
-			    &s->key[(s->direction == PF_IN)]->
-				addr[(s->direction == PF_OUT)],
-			    pd->af, pd->tot_len, dir == PF_OUT,
-			    r->action == PF_PASS, tr->src.neg);
-		if (tr->dst.addr.type == PF_ADDR_TABLE)
-			pfr_update_stats(tr->dst.addr.p.tbl,
-			    (s == NULL) ? pd->dst :
-			    &s->key[(s->direction == PF_IN)]->
-				addr[(s->direction == PF_IN)],
-			    pd->af, pd->tot_len, dir == PF_OUT,
-			    r->action == PF_PASS, tr->dst.neg);
+		/* Start with pre-NAT addresses */
+		key = s->key[(s->direction == PF_OUT)];
+		src_host = &(key->addr[s_dir_out]);
+		dst_host = &(key->addr[s_dir_in]);
+		af = key->af;
+		if (s->nat_rule) {
+			/* Old-style NAT rules */
+			if (s->nat_rule->action == PF_NAT ||
+			    s->nat_rule->action == PF_RDR ||
+			    s->nat_rule->action == PF_BINAT) {
+				nr = s->nat_rule;
+				pf_rule_counters_inc(pd, s->nat_rule, dir_out,
+				    op_pass, af, src_host, dst_host);
+				/* Use post-NAT addresses from now on */
+				key = s->key[s_dir_in];
+				src_host = &(key->addr[s_dir_out]);
+				dst_host = &(key->addr[s_dir_in]);
+				af = key->af;
+			}
+		}
 	}
+
+	SLIST_FOREACH(ri, mr, entry) {
+		pf_rule_counters_inc(pd, ri->r, dir_out, op_pass, af,
+		    src_host, dst_host);
+		if (s && s->nat_rule == ri->r) {
+			/* Use post-NAT addresses after a match NAT rule */
+			key = s->key[s_dir_in];
+			src_host = &(key->addr[s_dir_out]);
+			dst_host = &(key->addr[s_dir_in]);
+			af = key->af;
+		}
+	}
+
+	if (s == NULL) {
+		pf_free_match_rules(mr);
+	}
+
+	if (a != NULL) {
+		pf_rule_counters_inc(pd, a, dir_out, op_pass, af,
+		    src_host, dst_host);
+	}
+
+	if (r != nr) {
+		pf_rule_counters_inc(pd, r, dir_out, op_pass, af,
+		    src_host, dst_host);
+	}
+
 	pf_counter_u64_critical_exit();
 }
+
 static void
 pf_log_matches(struct pf_pdesc *pd, struct pf_krule *rm,
     struct pf_krule *am, struct pf_kruleset *ruleset,
-    struct pf_krule_slist *matchrules)
+    struct pf_krule_slist *match_rules)
 {
 	struct pf_krule_item	*ri;
 
@@ -10723,7 +10772,7 @@
 	if (rm->log & PF_LOG_MATCHES)
 		return;
 
-	SLIST_FOREACH(ri, matchrules, entry)
+	SLIST_FOREACH(ri, match_rules, entry)
 		if (ri->r->log & PF_LOG_MATCHES)
 			PFLOG_PACKET(rm->action, PFRES_MATCH, rm, am,
 			    ruleset, pd, 1, ri->r);
@@ -10740,6 +10789,8 @@
 	struct pf_krule		*a = NULL, *r = &V_pf_default_rule;
 	struct pf_kstate	*s = NULL;
 	struct pf_kruleset	*ruleset = NULL;
+	struct pf_krule_item	*ri;
+	struct pf_krule_slist	 match_rules;
 	struct pf_pdesc		 pd;
 	int			 use_2nd_queue = 0;
 	uint16_t		 tag;
@@ -10776,6 +10827,7 @@
 	}
 
 	pf_init_pdesc(&pd, *m0);
+	SLIST_INIT(&match_rules);
 
 	if (pd.pf_mtag != NULL && (pd.pf_mtag->flags & PF_MTAG_FLAG_ROUTE_TO)) {
 		pd.pf_mtag->flags &= ~PF_MTAG_FLAG_ROUTE_TO;
@@ -10872,7 +10924,7 @@
 			action = PF_DROP;
 		else
 			action = pf_test_rule(&r, &s, &pd, &a,
-			    &ruleset, &reason, inp);
+			    &ruleset, &reason, inp, &match_rules);
 		if (action != PF_PASS)
 			REASON_SET(&reason, PFRES_FRAG);
 		break;
@@ -10930,7 +10982,7 @@
 				break;
 			} else {
 				action = pf_test_rule(&r, &s, &pd,
-				    &a, &ruleset, &reason, inp);
+				    &a, &ruleset, &reason, inp, &match_rules);
 			}
 		}
 		break;
@@ -10951,7 +11003,7 @@
 			a = s->anchor;
 		} else if (s == NULL) {
 			action = pf_test_rule(&r, &s,
-			    &pd, &a, &ruleset, &reason, inp);
+			    &pd, &a, &ruleset, &reason, inp, &match_rules);
 		}
 		break;
 
@@ -10979,7 +11031,7 @@
 			a = s->anchor;
 		} else if (s == NULL)
 			action = pf_test_rule(&r, &s, &pd,
-			    &a, &ruleset, &reason, inp);
+			    &a, &ruleset, &reason, inp, &match_rules);
 		break;
 	}
 
@@ -10988,8 +11040,11 @@
 done:
 	PF_RULES_RUNLOCK();
 
-	if (pd.m == NULL)
+	/* if packet sits in reassembly queue, return without error */
+	if (pd.m == NULL) {
+		pf_free_match_rules(&match_rules);
 		goto eat_pkt;
+	}
 
 	if (s)
 		memcpy(&pd.act, &s->act, sizeof(s->act));
@@ -11086,6 +11141,8 @@
 			    (dir == PF_IN) ? PF_DIVERT_MTAG_DIR_IN :
 			    PF_DIVERT_MTAG_DIR_OUT;
 
+			pf_counters_inc(action, &pd, s, r, a, &match_rules);
+
 			if (s)
 				PF_STATE_UNLOCK(s);
 
@@ -11127,7 +11184,6 @@
 
 	if (pd.act.log) {
 		struct pf_krule		*lr;
-		struct pf_krule_item	*ri;
 
 		if (s != NULL && s->nat_rule != NULL &&
 		    s->nat_rule->log & PF_LOG_ALL)
@@ -11146,7 +11202,7 @@
 		}
 	}
 
-	pf_counters_inc(action, &pd, s, r, a);
+	pf_counters_inc(action, &pd, s, r, a, &match_rules);
 
 	switch (action) {
 	case PF_SYNPROXY_DROP:
diff --git a/tests/sys/netpfil/pf/Makefile b/tests/sys/netpfil/pf/Makefile
--- a/tests/sys/netpfil/pf/Makefile
+++ b/tests/sys/netpfil/pf/Makefile
@@ -5,6 +5,7 @@
 
 ATF_TESTS_SH+=	altq \
 		anchor \
+		counters \
 		debug \
 		divert-to \
 		dup \
diff --git a/tests/sys/netpfil/pf/counters.sh b/tests/sys/netpfil/pf/counters.sh
new file mode 100644
--- /dev/null
+++ b/tests/sys/netpfil/pf/counters.sh
@@ -0,0 +1,817 @@
+#
+# SPDX-License-Identifier: BSD-2-Clause
+#
+# Copyright (c) 2025 Kajetan Staszkiewicz
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+# ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+# SUCH DAMAGE.
+
+. $(atf_get_srcdir)/utils.subr
+
+get_counters()
+{
+	echo " === rules ==="
+	rules=$(mktemp) || exit
+	(jexec router pfctl -qvvsn ; jexec router pfctl -qvvsr) | normalize_pfctl_s > $rules
+	cat $rules
+
+	echo " === tables ==="
+	tables=$(mktemp) || exit 1
+	jexec router pfctl -qvvsT > $tables
+	cat $tables
+
+	echo " === states ==="
+	states=$(mktemp) || exit 1
+	jexec router pfctl -qvvss | normalize_pfctl_s > $states
+	cat $states
+
+	echo " === nodes ==="
+	nodes=$(mktemp) || exit 1
+	jexec router pfctl -qvvsS | normalize_pfctl_s > $nodes
+	cat $nodes
+}
+
+atf_test_case "match_pass_state" "cleanup"
+match_pass_state_head()
+{
+	atf_set descr 'Counters on match and pass rules'
+	atf_set require.user root
+}
+
+match_pass_state_body()
+{
+	setup_router_server_ipv6
+
+	# Thest counters for a statefull firewall. Expose the behaviour of
+	# increasing table counters if a table is used multiple times.
+	# The table "tbl_in" is used both in match and pass rule. It's counters
+	# are incremented twice. The tables "tbl_out_match" and "tbl_out_pass"
+	# are used only once and have their countes increased only once.
+	# Test source node counters for this simple scenario too.
+	pft_set_rules router \
+		"set state-policy if-bound" \
+		"table <tbl_in>  { ${net_tester_host_tester} }" \
+		"table <tbl_out_pass> { ${net_server_host_server} }" \
+		"table <tbl_out_match> { ${net_server_host_server} }" \
+		"block" \
+		"pass inet6 proto icmp6 icmp6-type { neighbrsol, neighbradv }" \
+		"match in  on ${epair_tester}b inet6 proto tcp from <tbl_in>  scrub (random-id)" \
+		"pass  in  on ${epair_tester}b inet6 proto tcp from <tbl_in>  keep state (max-src-states 3 source-track rule)" \
+		"match out on ${epair_server}a inet6 proto tcp to   <tbl_out_match> scrub (random-id)" \
+		"pass  out on ${epair_server}a inet6 proto tcp to   <tbl_out_pass> keep state"
+
+	# Use a real TCP connection so that it will be properly closed, guaranteeing the amount of packets.
+	atf_check -s exit:0 -o match:"This is a test" -x \
+		"echo 'This is a test' | nc -w3 ${net_server_host_server} echo"
+	# Let FINs pass through.
+	sleep 1
+	get_counters
+
+	for rule_regexp in \
+		"@3 match in on ${epair_tester}b .* Packets: 10 Bytes: 766 States: 1 " \
+		"@4 pass in on ${epair_tester}b .* Packets: 10 Bytes: 766 States: 1 " \
+		"@5 match out on ${epair_server}a .* Packets: 10 Bytes: 766 States: 1 " \
+		"@6 pass out on ${epair_server}a .* Packets: 10 Bytes: 766 States: 1 " \
+	; do
+		grep -qE "${rule_regexp}" $rules || atf_fail "Rule regexp not found for '${rule_regexp}'"
+	done
+
+	table_counters_single="Evaluations: NoMatch: 0 Match: 1 In/Block: Packets: 0 Bytes: 0 In/Pass: Packets: 4 Bytes: 311 In/XPass: Packets: 0 Bytes: 0 Out/Block: Packets: 0 Bytes: 0 Out/Pass: Packets: 6 Bytes: 455 Out/XPass: Packets: 0 Bytes: 0"
+	table_counters_double="Evaluations: NoMatch: 0 Match: 2 In/Block: Packets: 0 Bytes: 0 In/Pass: Packets: 12 Bytes: 910 In/XPass: Packets: 0 Bytes: 0 Out/Block: Packets: 0 Bytes: 0 Out/Pass: Packets: 8 Bytes: 622 Out/XPass: Packets: 0 Bytes: 0"
+	for table_test in \
+		"tbl_in___${table_counters_double}" \
+		"tbl_out_match___${table_counters_single}" \
+		"tbl_out_pass___${table_counters_single}" \
+	; do
+		table_name=${table_test%%___*}
+		table_regexp=${table_test##*___}
+		table=$(mktemp) || exit 1
+		cat $tables | grep -A10 $table_name | tr '\n' ' ' | awk '{gsub("[\\[\\]]", " ", $0); gsub("[[:blank:]]+"," ",$0); print $0}' > ${table}
+		grep -qE "${table_regexp}" ${table} || atf_fail "Bad counters for table ${table_name}"
+	done;
+
+	for state_regexp in \
+		"${epair_tester}b tcp ${net_server_host_server}.* <- ${net_tester_host_tester}.* 6:4 pkts, 455:311 bytes, rule 4," \
+		"${epair_server}a tcp ${net_server_host_tester}.* -> ${net_server_host_server}.* 6:4 pkts, 455:311 bytes, rule 6," \
+	; do
+		grep -qE "${state_regexp}" $states || atf_fail "State not found for '${state_regexp}'"
+	done
+
+	for node_regexp in \
+		"${net_tester_host_tester} -> :: .* 10 pkts, 766 bytes, filter rule 4, limit source-track"\
+	; do
+		grep -qE "${node_regexp}" $nodes || atf_fail "Source node not found for '${node_regexp}'"
+	done
+}
+
+match_pass_state_cleanup()
+{
+	pft_cleanup
+}
+
+atf_test_case "match_pass_no_state" "cleanup"
+match_pass_no_state_head()
+{
+	atf_set descr 'Counters on match and pass rules without keep state'
+	atf_set require.user root
+}
+
+match_pass_no_state_body()
+{
+	setup_router_server_ipv6
+
+	# Test counters for a stateless firewall.
+	# The table "tbl_in" is used both in match and pass rule in the inbound
+	# direction. The "In/Pass" counter is incremented twice. The table
+	# "tbl_inout" matches the same host on inbound and outbound direction.
+	# It will also be incremented twice. The tables "tbl_out_match" and
+	# "tbl_out_pass" will have their counters increased only once.
+	pft_set_rules router \
+		"table <tbl_in>        { ${net_tester_host_tester} }" \
+		"table <tbl_inout>     { ${net_tester_host_tester} }" \
+		"table <tbl_out_match> { ${net_server_host_server} }" \
+		"table <tbl_out_pass>  { ${net_server_host_server} }" \
+		"block" \
+		"pass inet6 proto icmp6 icmp6-type { neighbrsol, neighbradv }" \
+		"match in  on ${epair_tester}b inet6 proto tcp from <tbl_inout>" \
+		"match in  on ${epair_tester}b inet6 proto tcp from <tbl_in>" \
+		"pass  in  on ${epair_tester}b inet6 proto tcp from <tbl_in> no state" \
+		"pass  out on ${epair_tester}b inet6 proto tcp to   <tbl_in> no state" \
+		"match in  on ${epair_server}a inet6 proto tcp from <tbl_out_match>" \
+		"pass  in  on ${epair_server}a inet6 proto tcp from <tbl_out_pass>  no state" \
+		"match out on ${epair_server}a inet6 proto tcp from <tbl_inout> no state" \
+		"pass  out on ${epair_server}a inet6 proto tcp to   <tbl_out_pass>  no state"
+
+	# Use a real TCP connection so that it will be properly closed, guaranteeing the amount of packets.
+	atf_check -s exit:0 -o match:"This is a test" -x \
+		"echo 'This is a test' | nc -w3 ${net_server_host_server} echo"
+	sleep 1
+	get_counters
+
+	for rule_regexp in \
+		"@3 match in on ${epair_tester}b .* Packets: 6 Bytes: 455 " \
+		"@4 match in on ${epair_tester}b .* Packets: 6 Bytes: 455 " \
+		"@5 pass in on ${epair_tester}b .* Packets: 6 Bytes: 455 " \
+		"@6 pass out on ${epair_tester}b .* Packets: 4 Bytes: 311 " \
+		"@7 match in on ${epair_server}a .* Packets: 4 Bytes: 311 " \
+		"@8 pass in on ${epair_server}a .* Packets: 4 Bytes: 311 " \
+		"@10 pass out on ${epair_server}a .* Packets: 6 Bytes: 455 " \
+	; do
+		grep -qE "${rule_regexp}" $rules || atf_fail "Rule regexp not found for '${rule_regexp}'"
+	done
+
+	for table_test in \
+		"tbl_in___Evaluations: NoMatch: 0 Match: 16 In/Block: Packets: 0 Bytes: 0 In/Pass: Packets: 12 Bytes: 910 In/XPass: Packets: 0 Bytes: 0 Out/Block: Packets: 0 Bytes: 0 Out/Pass: Packets: 4 Bytes: 311 Out/XPass: Packets: 0 Bytes: 0" \
+		"tbl_out_match___Evaluations: NoMatch: 0 Match: 4 In/Block: Packets: 0 Bytes: 0 In/Pass: Packets: 4 Bytes: 311 In/XPass: Packets: 0 Bytes: 0 Out/Block: Packets: 0 Bytes: 0 Out/Pass: Packets: 0 Bytes: 0 Out/XPass: Packets: 0 Bytes: 0" \
+		"tbl_out_pass___Evaluations: NoMatch: 0 Match: 10 In/Block: Packets: 0 Bytes: 0 In/Pass: Packets: 4 Bytes: 311 In/XPass: Packets: 0 Bytes: 0 Out/Block: Packets: 0 Bytes: 0 Out/Pass: Packets: 6 Bytes: 455 Out/XPass: Packets: 0 Bytes: 0" \
+		"tbl_inout___Evaluations: NoMatch: 0 Match: 12 In/Block: Packets: 0 Bytes: 0 In/Pass: Packets: 6 Bytes: 455 In/XPass: Packets: 0 Bytes: 0 Out/Block: Packets: 0 Bytes: 0 Out/Pass: Packets: 6 Bytes: 455 Out/XPass: Packets: 0 Bytes: 0" \
+	; do
+		table_name=${table_test%%___*}
+		table_regexp=${table_test##*___}
+		table=$(mktemp) || exit 1
+		cat $tables | grep -A10 $table_name | tr '\n' ' ' | awk '{gsub("[\\[\\]]", " ", $0); gsub("[[:blank:]]+"," ",$0); print $0}' > ${table}
+		grep -qE "${table_regexp}" ${table} || atf_fail "Bad counters for table ${table_name}"
+	done;
+}
+
+match_pass_no_state_cleanup()
+{
+	pft_cleanup
+}
+
+atf_test_case "match_block" "cleanup"
+match_block_head()
+{
+	atf_set descr 'Counters on match and block rules'
+	atf_set require.user root
+}
+
+match_block_body()
+{
+	setup_router_server_ipv6
+
+	# Stateful firewall with a blocking rule. The rule will have its
+	# counters increased because it matches and applies correctly.
+	# The "match" rule before the "pass" rule will have its counters
+	# increased for blocked traffic too.
+	pft_set_rules router \
+		"set state-policy if-bound" \
+		"table <tbl_in_match> { ${net_server_host_server} }" \
+		"table <tbl_in_block> { ${net_server_host_server} }" \
+		"block" \
+		"pass inet6 proto icmp6 icmp6-type { neighbrsol, neighbradv }" \
+		"match  in on ${epair_tester}b inet6 proto tcp to   <tbl_in_match> scrub (random-id)" \
+		"block  in on ${epair_tester}b inet6 proto tcp to   <tbl_in_block>" \
+		"pass  out on ${epair_server}a inet6 proto tcp keep state"
+
+	# Wait 3 seconds, that will cause 2 SYNs to be sent out.
+	echo 'This is a test' | nc -w3 ${net_server_host_server} echo
+	sleep 1
+	get_counters
+
+	for rule_regexp in \
+		"@3 match in on ${epair_tester}b .* Packets: 2 Bytes: 160 States: 0 " \
+		"@4 block drop in on ${epair_tester}b .* Packets: 2 Bytes: 160 States: 0 " \
+	; do
+		grep -qE "${rule_regexp}" $rules || atf_fail "Rule regexp not found for '${rule_regexp}'"
+	done
+
+	# OpenBSD has (In|Out)/Match. We don't (yet) have it in FreeBSD
+	# so we follow the action of the "pass" rule ("block" for this test)
+	# in "match" rules.
+	for table_test in \
+		"tbl_in_match___Evaluations: NoMatch: 0 Match: 2 In/Block: Packets: 2 Bytes: 160 In/Pass: Packets: 0 Bytes: 0 In/XPass: Packets: 0 Bytes: 0 Out/Block: Packets: 0 Bytes: 0 Out/Pass: Packets: 0 Bytes: 0 Out/XPass: Packets: 0 Bytes: 0" \
+		"tbl_in_block___Evaluations: NoMatch: 0 Match: 2 In/Block: Packets: 2 Bytes: 160 In/Pass: Packets: 0 Bytes: 0 In/XPass: Packets: 0 Bytes: 0 Out/Block: Packets: 0 Bytes: 0 Out/Pass: Packets: 0 Bytes: 0 Out/XPass: Packets: 0 Bytes: 0" \
+	; do
+		table_name=${table_test%%___*}
+		table_regexp=${table_test##*___}
+		table=$(mktemp) || exit 1
+		cat $tables | grep -A10 $table_name | tr '\n' ' ' | awk '{gsub("[\\[\\]]", " ", $0); gsub("[[:blank:]]+"," ",$0); print $0}' > ${table}
+		grep -qE "${table_regexp}" ${table} || atf_fail "Bad counters for table ${table_name}"
+	done;
+}
+
+match_block_cleanup()
+{
+	pft_cleanup
+}
+
+atf_test_case "match_fail" "cleanup"
+match_fail_head()
+{
+	atf_set descr 'Counters on match and failing pass rules'
+	atf_set require.user root
+}
+
+match_fail_body()
+{
+	setup_router_server_ipv6
+
+	# Statefull firewall with a failing "pass" rule.
+	# When the rule can't apply it will not have its counters increased.
+	pft_set_rules router \
+		"set state-policy if-bound" \
+		"table <tbl_in_match> { ${net_server_host_server} }" \
+		"table <tbl_in_fail> { ${net_server_host_server} }" \
+		"block" \
+		"pass inet6 proto icmp6 icmp6-type { neighbrsol, neighbradv }" \
+		"match  in on ${epair_tester}b inet6 proto tcp to <tbl_in_match> scrub (random-id)" \
+		"pass   in on ${epair_tester}b inet6 proto tcp to <tbl_in_fail> keep state (max 1)" \
+		"pass  out on ${epair_server}a inet6 proto tcp keep state"
+
+	# The first test will pass and increase the counters for all rules.
+	echo 'This is a test' | nc -w3 ${net_server_host_server} echo
+	# The second test will go through the "match" rules but fail
+	# on the "pass" rule due to 'keep state (max 1)'.
+	# Wait 3 seconds, that will cause 2 SYNs to be sent out.
+	echo 'This is a test' | nc -w3 ${net_server_host_server} echo
+	sleep 1
+	get_counters
+
+	for rule_regexp in \
+		"@3 match in on ${epair_tester}b .* Packets: 10 Bytes: 766 States: 1 " \
+		"@4 pass in on ${epair_tester}b .* Packets: 10 Bytes: 766 States: 1 " \
+	; do
+		grep -qE "${rule_regexp}" $rules || atf_fail "Rule regexp not found for '${rule_regexp}'"
+	done
+
+	$table_counters_single="Evaluations: NoMatch: 0 Match: 3 In/Block: Packets: 0 Bytes: 0 In/Pass: Packets: 6 Bytes: 455 In/XPass: Packets: 0 Bytes: 0 Out/Block: Packets: 0 Bytes: 0 Out/Pass: Packets: 4 Bytes: 311 Out/XPass: Packets: 0 Bytes: 0"
+	for table_test in \
+		"tbl_in_match___${table_counters_single}" \
+		"tbl_in_fail___${table_counters_single}" \
+	; do
+		table_name=${table_test%%___*}
+		table_regexp=${table_test##*___}
+		table=$(mktemp) || exit 1
+		cat $tables | grep -A10 $table_name | tr '\n' ' ' | awk '{gsub("[\\[\\]]", " ", $0); gsub("[[:blank:]]+"," ",$0); print $0}' > ${table}
+		grep -qE "${table_regexp}" ${table} || atf_fail "Bad counters for table ${table_name}"
+	done;
+}
+
+match_fail_cleanup()
+{
+	pft_cleanup
+}
+
+atf_test_case "nat_natonly" "cleanup"
+nat_natonly_head()
+{
+	atf_set descr 'Counters on only a NAT rule creating state'
+	atf_set require.user root
+}
+
+nat_natonly_body()
+{
+	setup_router_server_ipv6
+
+	# NAT is applied on the "nat" rule.
+	# The "nat" rule matches on pre-NAT addresses. There is no separate
+	# "pass" rule so the "nat" rule creates the state.
+	pft_set_rules router \
+		"set state-policy if-bound" \
+		"table <tbl_src_nat> { ${net_tester_host_tester} }" \
+		"table <tbl_dst_nat> { ${net_server_host_server} }" \
+		"nat on ${epair_server}a inet6 proto tcp from <tbl_src_nat> to <tbl_dst_nat> -> ${net_server_host_router}"
+
+	# Use a real TCP connection so that it will be properly closed, guaranteeing the amount of packets.
+	atf_check -s exit:0 -o match:"This is a test" -x \
+		"echo 'This is a test' | nc -w3 ${net_server_host_server} echo"
+	sleep 1
+	get_counters
+
+	for rule_regexp in \
+		"@0 nat on ${epair_server}a .* Packets: 10 Bytes: 766 States: 1 " \
+	; do
+		grep -qE "${rule_regexp}" $rules || atf_fail "Rule regexp not found for '${rule_regexp}'"
+	done
+
+	# All tables have counters increased for In/Pass and Out/Pass, not XPass.
+	table_counters="Evaluations: NoMatch: 0 Match: 1 In/Block: Packets: 0 Bytes: 0 In/Pass: Packets: 4 Bytes: 311 In/XPass: Packets: 0 Bytes: 0 Out/Block: Packets: 0 Bytes: 0 Out/Pass: Packets: 6 Bytes: 455 Out/XPass: Packets: 0 Bytes: 0"
+	for table_test in \
+		"tbl_src_nat___${table_counters}" \
+		"tbl_dst_nat___${table_counters}" \
+	; do
+		table_name=${table_test%%___*}
+		table_regexp=${table_test##*___}
+		table=$(mktemp) || exit 1
+		cat $tables | grep -A10 $table_name | tr '\n' ' ' | awk '{gsub("[\\[\\]]", " ", $0); gsub("[[:blank:]]+"," ",$0); print $0}' > ${table}
+		grep -qE "${table_regexp}" ${table} || atf_fail "Bad counters for table ${table_name}"
+	done;
+
+	for state_regexp in \
+		"all tcp ${net_server_host_router}.* -> ${net_server_host_server}.* 6:4 pkts, 455:311 bytes" \
+	; do
+		grep -qE "${state_regexp}" $states || atf_fail "State not found for '${state_regexp}'"
+	done
+}
+
+nat_natonly_cleanup()
+{
+	pft_cleanup
+}
+
+atf_test_case "nat_nat" "cleanup"
+nat_nat_head()
+{
+	atf_set descr 'Counters on NAT, match and pass rules with keep state'
+	atf_set require.user root
+}
+
+nat_nat_body()
+{
+	setup_router_server_ipv6
+
+	# NAT is applied in the NAT ruleset.
+	# The "nat" rule matches on pre-NAT addresses.
+	# The "match" rule matches on post-NAT addresses.
+	# The "pass" rule matches on post-NAT addresses and creates the state.
+	pft_set_rules router \
+		"set state-policy if-bound" \
+		"table <tbl_src_nat> { ${net_tester_host_tester} }" \
+		"table <tbl_dst_nat> { ${net_server_host_server} }" \
+		"table <tbl_src_match> { ${net_server_host_router} }" \
+		"table <tbl_dst_match> { ${net_server_host_server} }" \
+		"table <tbl_src_pass> { ${net_server_host_router} }" \
+		"table <tbl_dst_pass> { ${net_server_host_server} }" \
+		"nat on ${epair_server}a inet6 proto tcp from <tbl_src_nat> to <tbl_dst_nat> -> ${net_server_host_router}" \
+		"block" \
+		"pass inet6 proto icmp6 icmp6-type { neighbrsol, neighbradv }" \
+		"pass  in  on ${epair_tester}b inet6 proto tcp keep state" \
+		"match out on ${epair_server}a inet6 proto tcp from <tbl_src_match> to <tbl_dst_match> scrub (random-id)" \
+		"pass  out on ${epair_server}a inet6 proto tcp from <tbl_src_pass>  to <tbl_dst_pass>  keep state"
+
+	# Use a real TCP connection so that it will be properly closed, guaranteeing the amount of packets.
+	atf_check -s exit:0 -o match:"This is a test" -x \
+		"echo 'This is a test' | nc -w3 ${net_server_host_server} echo"
+	sleep 1
+	get_counters
+
+	for rule_regexp in \
+		"@0 nat on ${epair_server}a .* Packets: 10 Bytes: 766 States: 1 " \
+		"@4 match out on ${epair_server}a .* Packets: 10 Bytes: 766 States: 1 " \
+		"@5 pass out on ${epair_server}a .* Packets: 10 Bytes: 766 States: 1 " \
+	; do
+		grep -qE "${rule_regexp}" $rules || atf_fail "Rule regexp not found for '${rule_regexp}'"
+	done
+
+	# All tables have counters increased for In/Pass and Out/Pass, not XPass nor Block.
+	table_counters="Evaluations: NoMatch: 0 Match: 1 In/Block: Packets: 0 Bytes: 0 In/Pass: Packets: 4 Bytes: 311 In/XPass: Packets: 0 Bytes: 0 Out/Block: Packets: 0 Bytes: 0 Out/Pass: Packets: 6 Bytes: 455 Out/XPass: Packets: 0 Bytes: 0"
+	for table_test in \
+		"tbl_src_nat___${table_counters}" \
+		"tbl_dst_nat___${table_counters}" \
+		"tbl_src_match___${table_counters}" \
+		"tbl_dst_match___${table_counters}" \
+		"tbl_src_pass___${table_counters}" \
+		"tbl_dst_pass___${table_counters}" \
+	; do
+		table_name=${table_test%%___*}
+		table_regexp=${table_test##*___}
+		table=$(mktemp) || exit 1
+		cat $tables | grep -A10 $table_name | tr '\n' ' ' | awk '{gsub("[\\[\\]]", " ", $0); gsub("[[:blank:]]+"," ",$0); print $0}' > ${table}
+		grep -qE "${table_regexp}" ${table} || atf_fail "Bad counters for table ${table_name}"
+	done;
+
+	for state_regexp in \
+		"${epair_server}a tcp ${net_server_host_router}.* -> ${net_server_host_server}.* 6:4 pkts, 455:311 bytes, rule 5," \
+	; do
+		grep -qE "${state_regexp}" $states || atf_fail "State not found for '${state_regexp}'"
+	done
+}
+
+nat_nat_cleanup()
+{
+	pft_cleanup
+}
+
+atf_test_case "nat_match" "cleanup"
+nat_match_head()
+{
+	atf_set descr 'Counters on match with NAT and pass rules'
+	atf_set require.user root
+}
+
+nat_match_body()
+{
+	setup_router_server_ipv6
+
+	# NAT is applied on the "match" rule.
+	# The "match" rule up to and including the NAT rule match on pre-NAT addresses.
+	# The "match" rule after NAT matches on post-NAT addresses.
+	# The "pass" rule matches on post-NAT addresses and creates the state.
+	pft_set_rules router \
+		"set state-policy if-bound" \
+		"table <tbl_src_match1> { ${net_tester_host_tester} }" \
+		"table <tbl_dst_match1> { ${net_server_host_server} }" \
+		"table <tbl_src_match2> { ${net_tester_host_tester} }" \
+		"table <tbl_dst_match2> { ${net_server_host_server} }" \
+		"table <tbl_src_match3> { ${net_server_host_router} }" \
+		"table <tbl_dst_match3> { ${net_server_host_server} }" \
+		"table <tbl_src_pass> { ${net_server_host_router} }" \
+		"table <tbl_dst_pass> { ${net_server_host_server} }" \
+		"block" \
+		"pass inet6 proto icmp6 icmp6-type { neighbrsol, neighbradv }" \
+		"pass  in  on ${epair_tester}b inet6 proto tcp keep state" \
+		"match out on ${epair_server}a inet6 proto tcp from <tbl_src_match1> to <tbl_dst_match1> scrub (random-id)" \
+		"match out on ${epair_server}a inet6 proto tcp from <tbl_src_match2> to <tbl_dst_match2> nat-to ${net_server_host_router}" \
+		"match out on ${epair_server}a inet6 proto tcp from <tbl_src_match3> to <tbl_dst_match3> scrub (random-id)" \
+		"pass  out on ${epair_server}a inet6 proto tcp from <tbl_src_pass>  to <tbl_dst_pass>  keep state"
+
+	# Use a real TCP connection so that it will be properly closed, guaranteeing the amount of packets.
+	atf_check -s exit:0 -o match:"This is a test" -x \
+		"echo 'This is a test' | nc -w3 ${net_server_host_server} echo"
+	sleep 1
+	get_counters
+
+	for rule_regexp in \
+		"@4 match out on ${epair_server}a .* Packets: 10 Bytes: 766 States: 1 " \
+		"@5 match out on ${epair_server}a .* Packets: 10 Bytes: 766 States: 1 " \
+		"@6 match out on ${epair_server}a .* Packets: 10 Bytes: 766 States: 1 " \
+		"@7 pass out on ${epair_server}a .* Packets: 10 Bytes: 766 States: 1 " \
+	; do
+		grep -qE "${rule_regexp}" $rules || atf_fail "Rule regexp not found for '${rule_regexp}'"
+	done
+
+	# All tables have counters increased for In/Pass and Out/Pass, not XPass nor Block.
+	table_counters="Evaluations: NoMatch: 0 Match: 1 In/Block: Packets: 0 Bytes: 0 In/Pass: Packets: 4 Bytes: 311 In/XPass: Packets: 0 Bytes: 0 Out/Block: Packets: 0 Bytes: 0 Out/Pass: Packets: 6 Bytes: 455 Out/XPass: Packets: 0 Bytes: 0"
+	for table_test in \
+		"tbl_src_match1___${table_counters}" \
+		"tbl_dst_match1___${table_counters}" \
+		"tbl_src_match2___${table_counters}" \
+		"tbl_dst_match2___${table_counters}" \
+		"tbl_src_match3___${table_counters}" \
+		"tbl_dst_match3___${table_counters}" \
+		"tbl_src_pass___${table_counters}" \
+		"tbl_dst_pass___${table_counters}" \
+	; do
+		table_name=${table_test%%___*}
+		table_regexp=${table_test##*___}
+		table=$(mktemp) || exit 1
+		cat $tables | grep -A10 $table_name | tr '\n' ' ' | awk '{gsub("[\\[\\]]", " ", $0); gsub("[[:blank:]]+"," ",$0); print $0}' > ${table}
+		grep -qE "${table_regexp}" ${table} || atf_fail "Bad counters for table ${table_name}"
+	done;
+
+	for state_regexp in \
+		"${epair_server}a tcp ${net_server_host_tester}.* -> ${net_server_host_server}.* 6:4 pkts, 455:311 bytes, rule 7, " \
+	; do
+		grep -qE "${state_regexp}" $states || atf_fail "State not found for '${state_regexp}'"
+	done
+}
+
+nat_match_cleanup()
+{
+	pft_cleanup
+}
+
+atf_test_case "nat_pass" "cleanup"
+nat_pass_head()
+{
+	atf_set descr 'Counters on match, and pass with NAT rules'
+	atf_set require.user root
+}
+
+nat_pass_body()
+{
+	setup_router_server_ipv6
+
+	# NAT is applied on the "pass" rule which also creates the state.
+	# All rules match on pre-NAT addresses.
+	pft_set_rules router \
+		"set state-policy if-bound" \
+		"table <tbl_src_match> { ${net_tester_host_tester} }" \
+		"table <tbl_dst_match> { ${net_server_host_server} }" \
+		"table <tbl_src_pass> { ${net_tester_host_tester} }" \
+		"table <tbl_dst_pass> { ${net_server_host_server} }" \
+		"block" \
+		"pass inet6 proto icmp6 icmp6-type { neighbrsol, neighbradv }" \
+		"pass  in  on ${epair_tester}b inet6 proto tcp keep state" \
+		"match out on ${epair_server}a inet6 proto tcp from <tbl_src_match> to <tbl_dst_match> scrub (random-id)" \
+		"pass  out on ${epair_server}a inet6 proto tcp from <tbl_src_pass>  to <tbl_dst_pass>  nat-to ${net_server_host_router} keep state"
+
+	# Use a real TCP connection so that it will be properly closed, guaranteeing the amount of packets.
+	atf_check -s exit:0 -o match:"This is a test" -x \
+		"echo 'This is a test' | nc -w3 ${net_server_host_server} echo"
+	sleep 1
+	get_counters
+
+	for rule_regexp in \
+		"@4 match out on ${epair_server}a .* Packets: 10 Bytes: 766 States: 1 " \
+		"@5 pass out on ${epair_server}a .* Packets: 10 Bytes: 766 States: 1 " \
+	; do
+		grep -qE "${rule_regexp}" $rules || atf_fail "Rule regexp not found for '${rule_regexp}'"
+	done
+
+	table_counters="Evaluations: NoMatch: 0 Match: 1 In/Block: Packets: 0 Bytes: 0 In/Pass: Packets: 4 Bytes: 311 In/XPass: Packets: 0 Bytes: 0 Out/Block: Packets: 0 Bytes: 0 Out/Pass: Packets: 6 Bytes: 455 Out/XPass: Packets: 0 Bytes: 0"
+	for table_test in \
+		"tbl_src_match___${table_counters}" \
+		"tbl_dst_match___${table_counters}" \
+		"tbl_src_pass___${table_counters}" \
+		"tbl_dst_pass___${table_counters}" \
+	; do
+		table_name=${table_test%%___*}
+		table_regexp=${table_test##*___}
+		table=$(mktemp) || exit 1
+		cat $tables | grep -A10 $table_name | tr '\n' ' ' | awk '{gsub("[\\[\\]]", " ", $0); gsub("[[:blank:]]+"," ",$0); print $0}' > ${table}
+		grep -qE "${table_regexp}" ${table} || atf_fail "Bad counters for table ${table_name}"
+	done;
+
+	for state_regexp in \
+		"${epair_server}a tcp ${net_server_host_router}.* -> ${net_server_host_server}.* 6:4 pkts, 455:311 bytes, rule 5," \
+	; do
+		grep -qE "${state_regexp}" $states || atf_fail "State not found for '${state_regexp}'"
+	done
+}
+
+nat_pass_cleanup()
+{
+	pft_cleanup
+}
+
+atf_test_case "rdr_match" "cleanup"
+rdr_match_head()
+{
+	atf_set descr 'Counters on match with RDR and pass rules'
+	atf_set require.user root
+}
+
+rdr_match_body()
+{
+	setup_router_server_ipv6
+
+	# Similar to the nat_match test but for the RDR action.
+	# Hopefully we don't need all other tests duplicated for RDR.
+	# Send traffic to a non-existing host, RDR it to the server.
+	#
+	# The "match" rule up to and including the RDR rule match on pre-RDR dst address.
+	# The "match" rule after NAT matches on post-RDR dst address.
+	# The "pass" rule matches on post-RDR dst address.
+	net_server_host_notserver=${net_server_host_server%%::*}::3
+	pft_set_rules router \
+		"set state-policy if-bound" \
+		"table <tbl_src_match1> { ${net_tester_host_tester} }" \
+		"table <tbl_dst_match1> { ${net_server_host_notserver} }" \
+		"table <tbl_src_match2> { ${net_tester_host_tester} }" \
+		"table <tbl_dst_match2> { ${net_server_host_notserver} }" \
+		"table <tbl_src_match3> { ${net_tester_host_tester} }" \
+		"table <tbl_dst_match3> { ${net_server_host_server} }" \
+		"table <tbl_src_pass> { ${net_tester_host_tester} }" \
+		"table <tbl_dst_pass> { ${net_server_host_server} }" \
+		"block" \
+		"pass inet6 proto icmp6 icmp6-type { neighbrsol, neighbradv }" \
+		"pass  out on ${epair_server}a inet6 proto tcp keep state" \
+		"match  in on ${epair_tester}b inet6 proto tcp from <tbl_src_match1> to <tbl_dst_match1> scrub (random-id)" \
+		"match  in on ${epair_tester}b inet6 proto tcp from <tbl_src_match2> to <tbl_dst_match2> rdr-to ${net_server_host_server}" \
+		"match  in on ${epair_tester}b inet6 proto tcp from <tbl_src_match3> to <tbl_dst_match3> scrub (random-id)" \
+		"pass   in on ${epair_tester}b inet6 proto tcp from <tbl_src_pass>  to <tbl_dst_pass>  keep state"
+
+	# Use a real TCP connection so that it will be properly closed, guaranteeing the amount of packets.
+	atf_check -s exit:0 -o match:"This is a test" -x \
+		"echo 'This is a test' | nc -w3 ${net_server_host_notserver} echo"
+	sleep 1
+	get_counters
+
+	for rule_regexp in \
+		"@4 match in on ${epair_tester}b .* Packets: 10 Bytes: 766 States: 1 " \
+		"@5 match in on ${epair_tester}b .* Packets: 10 Bytes: 766 States: 1 " \
+		"@6 match in on ${epair_tester}b .* Packets: 10 Bytes: 766 States: 1 " \
+		"@7 pass in on ${epair_tester}b .* Packets: 10 Bytes: 766 States: 1 " \
+	; do
+		grep -qE "${rule_regexp}" $rules || atf_fail "Rule regexp not found for '${rule_regexp}'"
+	done
+
+	# All tables have counters increased for In/Pass and Out/Pass, not XPass nor Block.
+	table_counters="Evaluations: NoMatch: 0 Match: 1 In/Block: Packets: 0 Bytes: 0 In/Pass: Packets: 6 Bytes: 455 In/XPass: Packets: 0 Bytes: 0 Out/Block: Packets: 0 Bytes: 0 Out/Pass: Packets: 4 Bytes: 311 Out/XPass: Packets: 0 Bytes: 0"
+	for table_test in \
+		"tbl_src_match1___${table_counters}" \
+		"tbl_dst_match1___${table_counters}" \
+		"tbl_src_match2___${table_counters}" \
+		"tbl_dst_match2___${table_counters}" \
+		"tbl_src_match3___${table_counters}" \
+		"tbl_dst_match3___${table_counters}" \
+		"tbl_src_pass___${table_counters}" \
+		"tbl_dst_pass___${table_counters}" \
+	; do
+		table_name=${table_test%%___*}
+		table_regexp=${table_test##*___}
+		table=$(mktemp) || exit 1
+		cat $tables | grep -A10 $table_name | tr '\n' ' ' | awk '{gsub("[\\[\\]]", " ", $0); gsub("[[:blank:]]+"," ",$0); print $0}' > ${table}
+		grep -qE "${table_regexp}" ${table} || atf_fail "Bad counters for table ${table_name}"
+	done;
+
+	for state_regexp in \
+		"${epair_tester}b tcp ${net_server_host_server}.* 6:4 pkts, 455:311 bytes, rule 7, " \
+	; do
+		grep -qE "${state_regexp}" $states || atf_fail "State not found for '${state_regexp}'"
+	done
+}
+
+rdr_match_cleanup()
+{
+	pft_cleanup
+}
+
+atf_test_case "nat64_in" "cleanup"
+nat64_in_head()
+{
+	atf_set descr 'Counters on match and inbound af-to rules'
+	atf_set require.user root
+}
+
+nat64_in_body()
+{
+	setup_router_server_nat64
+
+	pft_set_rules router \
+		"set state-policy if-bound" \
+		"table <tbl_src_match> { ${net_tester_6_host_tester} }" \
+		"table <tbl_dst_match> { 64:ff9b::${net_server1_4_host_server} }" \
+		"table <tbl_src_pass>  { ${net_tester_6_host_tester} }" \
+		"table <tbl_dst_pass>  { 64:ff9b::${net_server1_4_host_server} }" \
+		"block" \
+		"pass inet6 proto icmp6 icmp6-type { neighbrsol, neighbradv }" \
+		"match  in on ${epair_tester}b inet6 proto tcp from <tbl_src_match> to <tbl_dst_match> scrub (random-id)" \
+		"pass   in on ${epair_tester}b inet6 proto tcp from <tbl_src_pass>  to <tbl_dst_pass> \
+			af-to inet from (${epair_server1}a) \
+			keep state"
+
+	# Use a real TCP connection so that it will be properly closed, guaranteeing the amount of packets.
+	atf_check -s exit:0 -o match:"This is a test" -x \
+		"echo 'This is a test' | nc -w3 64:ff9b::${net_server1_4_host_server} echo"
+	sleep 1
+	get_counters
+
+	# The amount of packets is counted properly but sizes are not because
+	# pd->tot_len is always post-nat, even when updating pre-nat counters.
+	for rule_regexp in \
+		"@3 match in on ${epair_tester}b .* Packets: 10 Bytes: 686 States: 1 " \
+		"@4 pass in on ${epair_tester}b .* Packets: 10 Bytes: 686 States: 1 " \
+	; do
+		grep -qE "${rule_regexp}" $rules || atf_fail "Rule regexp not found for '${rule_regexp}'"
+	done
+
+	# All tables have counters increased for In/Pass and Out/Pass, not XPass nor Block.
+	table_counters="Evaluations: NoMatch: 0 Match: 1 In/Block: Packets: 0 Bytes: 0 In/Pass: Packets: 4 Bytes: 231 In/XPass: Packets: 0 Bytes: 0 Out/Block: Packets: 0 Bytes: 0 Out/Pass: Packets: 6 Bytes: 455 Out/XPass: Packets: 0 Bytes: 0"
+	for table_test in \
+		"tbl_src_match___${table_counters}" \
+		"tbl_dst_match___${table_counters}" \
+		"tbl_src_pass___${table_counters}" \
+		"tbl_dst_pass___${table_counters}" \
+	; do
+		table_name=${table_test%%___*}
+		table_regexp=${table_test##*___}
+		table=$(mktemp) || exit 1
+		cat $tables | grep -A10 $table_name | tr '\n' ' ' | awk '{gsub("[\\[\\]]", " ", $0); gsub("[[:blank:]]+"," ",$0); print $0}' > ${table}
+		grep -qE "${table_regexp}" ${table} || atf_fail "Bad counters for table ${table_name}"
+	done;
+
+	for state_regexp in \
+		"${epair_server1}a tcp ${net_server_host_tester}.* 6:4 pkts, 455:231 bytes, rule 4, " \
+	; do
+		grep -qE "${state_regexp}" $states || atf_fail "State not found for '${state_regexp}'"
+	done
+}
+
+nat64_in_cleanup()
+{
+	pft_cleanup
+}
+
+atf_test_case "nat64_out" "cleanup"
+nat64_out_head()
+{
+	atf_set descr 'Counters on match and outbound af-to rules'
+	atf_set require.user root
+}
+
+nat64_out_body()
+{
+	setup_router_server_nat64
+
+	# af-to in outbound path requires routes for the pre-af-to traffic.
+	jexec router route add -inet6 64:ff9b::/96 -iface ${epair_server1}a
+
+	pft_set_rules router \
+		"set state-policy if-bound" \
+		"table <tbl_src_match> { ${net_tester_6_host_tester} }" \
+		"table <tbl_dst_match> { 64:ff9b::${net_server1_4_host_server} }" \
+		"table <tbl_src_pass>  { ${net_tester_6_host_tester} }" \
+		"table <tbl_dst_pass>  { 64:ff9b::${net_server1_4_host_server} }" \
+		"block" \
+		"pass inet6 proto icmp6 icmp6-type { neighbrsol, neighbradv }" \
+		"pass  in  on ${epair_tester}b inet6 proto tcp keep state" \
+		"match out on ${epair_server1}a inet6 proto tcp from <tbl_src_match> to <tbl_dst_match> scrub (random-id)" \
+		"pass  out on ${epair_server1}a inet6 proto tcp from <tbl_src_pass>  to <tbl_dst_pass> \
+			af-to inet from (${epair_server1}a) \
+			keep state"
+
+	# Use a real TCP connection so that it will be properly closed, guaranteeing the amount of packets.
+	atf_check -s exit:0 -o match:"This is a test" -x \
+		"echo 'This is a test' | nc -w3 64:ff9b::${net_server1_4_host_server} echo"
+	sleep 1
+	get_counters
+
+	for rule_regexp in \
+		"@4 match out on ${epair_server1}a .* Packets: 10 Bytes: 686 States: 1 " \
+		"@5 pass out on ${epair_server1}a .* Packets: 10 Bytes: 686 States: 1 " \
+	; do
+		grep -qE "${rule_regexp}" $rules || atf_fail "Rule regexp not found for '${rule_regexp}'"
+	done
+
+	# All tables have counters increased for In/Pass and Out/Pass, not XPass nor Block.
+	table_counters="Evaluations: NoMatch: 0 Match: 1 In/Block: Packets: 0 Bytes: 0 In/Pass: Packets: 4 Bytes: 231 In/XPass: Packets: 0 Bytes: 0 Out/Block: Packets: 0 Bytes: 0 Out/Pass: Packets: 6 Bytes: 455 Out/XPass: Packets: 0 Bytes: 0"
+	for table_test in \
+		"tbl_src_match___${table_counters}" \
+		"tbl_dst_match___${table_counters}" \
+		"tbl_src_pass___${table_counters}" \
+		"tbl_dst_pass___${table_counters}" \
+	; do
+		table_name=${table_test%%___*}
+		table_regexp=${table_test##*___}
+		table=$(mktemp) || exit 1
+		cat $tables | grep -A10 $table_name | tr '\n' ' ' | awk '{gsub("[\\[\\]]", " ", $0); gsub("[[:blank:]]+"," ",$0); print $0}' > ${table}
+		grep -qE "${table_regexp}" ${table} || atf_fail "Bad counters for table ${table_name}"
+	done;
+
+	for state_regexp in \
+		"${epair_server1}a tcp 198.51.100.17:[0-9]+ \(64:ff9b::c633:6412\[7\]\) -> 198.51.100.18:7 \(2001:db8:4200::2\[[0-9]+\]\) .* 6:4 pkts, 455:231 bytes, rule 5," \
+	; do
+		grep -qE "${state_regexp}" $states || atf_fail "State not found for '${state_regexp}'"
+	done
+}
+
+nat64_out_cleanup()
+{
+	pft_cleanup
+}
+
+atf_init_test_cases()
+{
+	atf_add_test_case "match_pass_state"
+	atf_add_test_case "match_pass_no_state"
+	atf_add_test_case "match_block"
+	atf_add_test_case "match_fail"
+	atf_add_test_case "nat_natonly"
+	atf_add_test_case "nat_nat"
+	atf_add_test_case "nat_match"
+	atf_add_test_case "nat_pass"
+	atf_add_test_case "rdr_match"
+	atf_add_test_case "nat64_in"
+	atf_add_test_case "nat64_out"
+}
diff --git a/tests/sys/netpfil/pf/nat64.sh b/tests/sys/netpfil/pf/nat64.sh
--- a/tests/sys/netpfil/pf/nat64.sh
+++ b/tests/sys/netpfil/pf/nat64.sh
@@ -213,12 +213,14 @@
 		atf_fail "Failed to connect to TCP server"
 	fi
 
+	sleep 1
+
 	# Interfaces of the state are reversed when doing inbound NAT64!
 	# FIXME: Packets from both directions are counted only on the inbound direction!
 	states=$(mktemp) || exit 1
 	jexec rtr pfctl -qvvss | normalize_pfctl_s > $states
 	for state_regexp in \
-		"${epair_link}a tcp 192.0.2.1:[0-9]+ \(2001:db8::2\[[0-9]+\]\) -> 192.0.2.2:1234 \(64:ff9b::c000:202\[1234\]\) .* 9:0 pkts.* rule 3 .* origif: ${epair}b" \
+		"${epair_link}a tcp 192.0.2.1:[0-9]+ \(2001:db8::2\[[0-9]+\]\) -> 192.0.2.2:1234 \(64:ff9b::c000:202\[1234\]\) .* 5:4 pkts.* rule 3 .* origif: ${epair}b" \
 	; do
 		grep -qE "${state_regexp}" $states || atf_fail "State not found for '${state_regexp}'"
 	done
@@ -254,6 +256,8 @@
 		atf_fail "Failed to connect to TCP server"
 	fi
 
+	sleep 1
+
 	# Origif is not printed when identical as if.
 	states=$(mktemp) || exit 1
 	jexec rtr pfctl -qvvss | normalize_pfctl_s > $states
@@ -295,12 +299,14 @@
 		atf_fail "Failed to connect to TCP server"
 	fi
 
+	sleep 1
+
 	# Interfaces of the state are reversed when doing inbound NAT64!
 	# FIXME: Packets from both directions are counted only on the inbound direction!
 	states=$(mktemp) || exit 1
 	jexec rtr pfctl -qvvss | normalize_pfctl_s > $states
 	for state_regexp in \
-		"all tcp 192.0.2.1:[0-9]+ \(2001:db8::2\[[0-9]+\]\) -> 192.0.2.2:1234 \(64:ff9b::c000:202\[1234\]\).* 9:0 pkts.* rule 3 .* origif: ${epair}b" \
+		"all tcp 192.0.2.1:[0-9]+ \(2001:db8::2\[[0-9]+\]\) -> 192.0.2.2:1234 \(64:ff9b::c000:202\[1234\]\).* 5:4 pkts.* rule 3 .* origif: ${epair}b" \
 	; do
 		grep -qE "${state_regexp}" $states || atf_fail "State not found for '${state_regexp}'"
 	done
@@ -336,6 +342,8 @@
 		atf_fail "Failed to connect to TCP server"
 	fi
 
+	sleep 1
+
 	# Origif is not printed when identical as if.
 	states=$(mktemp) || exit 1
 	jexec rtr pfctl -qvvss | normalize_pfctl_s > $states
@@ -1011,20 +1019,19 @@
 	pft_init
 
 	epair_link=$(vnet_mkepair)
-	epair_null=$(vnet_mkepair)
 	epair=$(vnet_mkepair)
 
 	ifconfig ${epair}a inet6 2001:db8::2/64 up no_dad
 	route -6 add default 2001:db8::1
 
-	vnet_mkjail rtr ${epair}b ${epair_link}a ${epair_null}a
+	vnet_mkjail rtr ${epair}b ${epair_link}a
 	jexec rtr ifconfig ${epair}b inet6 2001:db8::1/64 up no_dad
-	jexec rtr ifconfig ${epair_null}a 192.0.2.3/24 up
 	jexec rtr ifconfig ${epair_link}a 192.0.2.1/24 up
 
 	vnet_mkjail dst ${epair_link}b
 	jexec dst ifconfig ${epair_link}b 192.0.2.2/24 up
-	jexec dst route add default 192.0.2.1
+	jexec dst ifconfig lo0 203.0.113.1/32 alias
+	jexec dst route add default 192.0.2.2
 
 	# Sanity checks
 	atf_check -s exit:0 -o ignore \
@@ -1033,8 +1040,9 @@
 	jexec rtr pfctl -e
 	pft_set_rules rtr \
 	    "set reassemble yes" \
+	    "set debug loud" \
 	    "set state-policy if-bound" \
-	    "block" \
+	    "block log (all)" \
 	    "pass inet6 proto icmp6 icmp6-type { neighbrsol, neighbradv }" \
 	    "pass in on ${epair}b route-to (${epair_link}a 192.0.2.2) inet6 from any to 64:ff9b::/96 af-to inet from (${epair_link}a)"
 
@@ -1044,11 +1052,11 @@
 
 	states=$(mktemp) || exit 1
 	jexec rtr pfctl -qvvss | normalize_pfctl_s > $states
+	cat $states
 
 	# Interfaces of the state are reversed when doing inbound NAT64!
-	# FIXME: Packets from both directions are counted only on the inbound direction!
 	for state_regexp in \
-		"${epair_link}a ipv6-icmp 192.0.2.1:.* \(2001:db8::2\[[0-9]+\]\) -> 192.0.2.2:8 \(64:ff9b::c000:202\[[0-9]+\]\).* 6:0 pkts.*route-to: 192.0.2.2@${epair_link}a origif: ${epair}b" \
+		"${epair_link}a ipv6-icmp 192.0.2.1:.* \(2001:db8::2\[[0-9]+\]\) -> 192.0.2.2:8 \(64:ff9b::c000:202\[[0-9]+\]\).* 3:3 pkts.*route-to: 192.0.2.2@${epair_link}a origif: ${epair}b" \
 	; do
 		grep -qE "${state_regexp}" $states || atf_fail "State not found for '${state_regexp}'"
 	done
diff --git a/tests/sys/netpfil/pf/utils.subr b/tests/sys/netpfil/pf/utils.subr
--- a/tests/sys/netpfil/pf/utils.subr
+++ b/tests/sys/netpfil/pf/utils.subr
@@ -217,6 +217,7 @@
 	jexec server route add -net ${net_tester} ${net_server_host_router}
 	inetd_conf=$(mktemp)
 	echo "discard stream tcp nowait root internal" > $inetd_conf
+	echo "echo stream tcp nowait root internal" >> $inetd_conf
 	jexec server inetd -p ${PWD}/inetd.pid $inetd_conf
 }
 
@@ -271,6 +272,7 @@
 	jexec server route add -6 ${net_tester} ${net_server_host_router}
 	inetd_conf=$(mktemp)
 	echo "discard stream tcp6 nowait root internal" > $inetd_conf
+	echo "echo stream tcp6 nowait root internal" >> $inetd_conf
 	jexec server inetd -p ${PWD}/inetd.pid $inetd_conf
 }
 
@@ -353,6 +355,7 @@
 
 	inetd_conf=$(mktemp)
 	echo "discard stream tcp46 nowait root internal" >> $inetd_conf
+	echo "echo stream tcp46 nowait root internal" >> $inetd_conf
 
 	vnet_mkjail server1 ${epair_server1}b
 	jexec server1 /etc/rc.d/netif start lo0