Has PF support for ingress divert-packet rule

Hello dear OpenBSD Folks,



I'm trying to use PF's divert-packet feature at inbound connections.

I have a simple config:

LAN side : vlan10

WAN side : pppoe0

Divert's man page sample C code is running at port raw:700

My pf.conf (Not all lines...)

set skip on { lo0 }

set block-policy drop

#

block log all

pass in log quick on vlan10 inet proto icmp from vlan10:network to any
pass in log quick on vlan10 inet proto udp from vlan10:network to <allowed_dns_servers> port 53
pass in log quick on vlan10 inet proto tcp from 10.10.10.10 to any port { 80 443 } divert-packet port 700

pass out log quick on egress inet from 10.10.10.10 to any nat-to (egress)

#

pass out from (vlan10)

pass out from (pppoe0)



Here divert logs by divert.c program

# ./divert

10.10.10.10:53317 -> 129.128.5.194:443

10.10.10.10:53317 -> 129.128.5.194:443

10.10.10.10:53317 -> 129.128.5.194:443

10.10.10.10:53317 -> 129.128.5.194:443

10.10.10.10:53317 -> 129.128.5.194:443

10.10.10.10:53317 -> 129.128.5.194:443

10.10.10.10:53317 -> 129.128.5.194:443

10.10.10.10:53315 -> 129.128.5.194:443

10.10.10.10:53316 -> 129.128.5.194:443

10.10.10.10:53317 -> 129.128.5.194:443



Here log from tcpdump. 
rule 5/(match) pass in on vlan10: 10.10.10.10.53317 > 129.128.5.194.443: S 3698415379:3698415379(0) win 65535 <mss 1460,nop,wscale 6,nop,nop,timestamp 988128219 0,sackOK,eol> (DF)



But no web page is displayed while ingress divert-packet rule is online.

If i write divert-packet rules as outbound; it's ok. But this is not what i want. Because of the NAT's nature; i can not see my-private-ip-address as the source. 



Has PF support for ingress divert-packet rules?

Or is it possible to (use) divert-packet before NAT operations at egress interface?



Thanks in advance.



--

Best Regards

Anton