It's a bit funny that the help text indicates we can use tag/tagged with
NAT rules as well, because this was never implemented although it really
works.