Pools multiple targets for a single rdr/nat rule or route-to option NATing to multiple public addresses or netblocks: nat on kue0 from 10.0.0.0/8 to any -> \ { 1.2.3.4, 2.3.4.5, 3.4.0.0/16 } round-robin load-balancing through several interfaces: pass out on kue route-to { kue0, kue1, kue2 } round-robin \ keep state various allocation schemes: round-robin loops through the targets sequentially source-hash hashes the source address so the same source address is always mapped to the same target bitmask replaces the network part of the source address, e.g. a.b.4.5 is mapped to x.y.4.5 random selects a random target stateful filtering, deal with connections, not packets