10.2-RELEASE not forwarding packets/NATing with pf

[Sergey Grigorian]

> > > > And here's /etc/sysctl.conf:
> > > >
> > > > net.inet.ip.forwarding=1
> > > >
> >
> > > Hi,
> > >         This does not work the way it might have in the past. Make
> > > sure you set gateway_enable="YES"
> > > in /etc/rc.conf
> > > otherwise, devd and /etc/rc.d/routing will reset
> > > net.inet.ip.forwarding to 0 on certain network events.
> > >
> > >         ---Mike
> >
> > Mike,
> > thanks for your suggestion.
> > I have gateway_enable="YES" set in /etc/rc.conf
> > Is there anything else I miss?
> >
> > Here's the /etc/rc.conf itself:
> > defaultrouter=172.16.0.1
> > ifconfig_hn0="inet 172.16.0.3 netmask 255.255.255.0"
> > ifconfig_hn0_alias0="inet 172.16.0.4 netmask 255.255.255.255"
> > ifconfig_hn1="inet 172.16.1.1 netmask 255.255.255.0"
> > ifconfig_hn1_alias0="inet 172.16.1.7 netmask 255.255.255.255"
> > gateway_enable="YES"
> > pf_enable="YES"
> > pflog_enable="YES"
> > sshd_enable="YES"
> > ntpd_enable="YES"
> > ntpd_sync_on_start="YES"
> > cron_enable="YES"
> > cron_flags="-j 60 -J 60"
> > syslogd_flags="-ss"
> > sendmail_enable="NO"
> > sendmail_submit_enable="NO"
> > sendmail_outbound_enable="NO"
> > sendmail_msp_queue_enable="NO"
> > accounting_enable="YES"
> > tcp_drop_synfin="YES"
> > icmp_drop_redirect="YES"
> > clear_tmp_enable="YES"
 
> I know this sounds obvious but do you have
> 
> device          pf
> device          pflog
> 
> in your kernel? or pf.ko loaded ?

Mario,
I load pf as a module, so pf.ko is loaded. This box runs a stock RELEASE kernel.
What confuses me is that this setup works perfectly on 10.1, but stops working the second I boot into the 10.2-RELEASE-p2 kernel.