sorry for the disturbing time i find: rdr on $if_ext proto tcp from $int_net to <pub ip> port 80 -> \ <priv ip> nat on $if_int inet from <priv ip> to any -> <pub ip> i nat on the internal interface and it is just working