diff --git a/sbin/pfctl/parse.y b/sbin/pfctl/parse.y
index 99c26c0a33d..cc7ac38f5ce 100644
--- a/sbin/pfctl/parse.y
+++ b/sbin/pfctl/parse.y
@@ -436,7 +436,7 @@ int	parseport(char *, struct range *r, int);
 
 %}
 
-%token	PASS BLOCK SCRUB RETURN IN OS OUT LOG QUICK ON FROM TO FLAGS
+%token	PASS BLOCK MATCH SCRUB RETURN IN OS OUT LOG QUICK ON FROM TO FLAGS
 %token	RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE
 %token	ICMP6TYPE CODE KEEP MODULATE STATE PORT RDR NAT BINAT ARROW NODF
 %token	MINTTL ERROR ALLOWOPTS FASTROUTE FILENAME ROUTETO DUPTO REPLYTO NO LABEL
@@ -2421,6 +2421,7 @@ probability	: STRING				{
 
 
 action		: PASS			{ $$.b1 = PF_PASS; $$.b2 = $$.w = 0; }
+                | MATCH                 { $$.b1 = PF_MATCH; $$.b2 = $$.w = 0; }
 		| BLOCK blockspec	{ $$ = $2; $$.b1 = PF_DROP; }
 		;
 
@@ -5262,6 +5263,7 @@ lookup(char *s)
 		{ "load",		LOAD},
 		{ "log",		LOG},
 		{ "loginterface",	LOGINTERFACE},
+                { "match",              MATCH},
 		{ "max",		MAXIMUM},
 		{ "max-mss",		MAXMSS},
 		{ "max-src-conn",	MAXSRCCONN},
diff --git a/sbin/pfctl/pfctl_parser.c b/sbin/pfctl/pfctl_parser.c
index 1f4375aced1..1652a7bca47 100644
--- a/sbin/pfctl/pfctl_parser.c
+++ b/sbin/pfctl/pfctl_parser.c
@@ -692,7 +692,9 @@ print_rule(struct pf_rule *r, const char *anchor_call, int verbose, int numeric)
 
 	if (verbose)
 		printf("@%d ", r->nr);
-	if (r->action > PF_NORDR)
+        if (r->action == PF_MATCH)
+                printf("match");
+        else if (r->action > PF_NORDR)
 		printf("action(%d)", r->action);
 	else if (anchor_call[0]) {
 		if (anchor_call[0] == '_') {
diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h
index ae5ecb9e6be..93c01468622 100644
--- a/sys/net/pfvar.h
+++ b/sys/net/pfvar.h
@@ -465,6 +465,12 @@ struct pf_osfp_ioctl {
 	int			fp_getnum;	/* DIOCOSFPGET number */
 };
 
+struct pf_rule_actions {
+        u_int16_t       qid;
+        u_int16_t       pqid;
+        u_int8_t        flags;
+};
+
 
 union pf_rule_ptr {
 	struct pf_rule		*ptr;
@@ -730,6 +736,8 @@ struct pf_state {
 	u_int32_t		 creation;
 	u_int32_t	 	 expire;
 	u_int32_t		 pfsync_time;
+        u_int16_t                qid;
+        u_int16_t                pqid;
 	u_int16_t		 tag;
 	u_int8_t		 log;
 	u_int8_t		 state_flags;
@@ -1101,6 +1109,7 @@ struct pf_pdesc {
 	u_int16_t *sport;
 	u_int16_t *dport;
 	struct pf_mtag	*pf_mtag;
+        struct pf_rule_actions   act;
 
 	u_int32_t	 p_len;		/* total length of payload */
 
diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index 48da8807798..e2006c2ed81 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -226,6 +226,8 @@ static int		 pf_state_key_attach(struct pf_state_key *,
 static void		 pf_state_key_detach(struct pf_state *, int);
 static int		 pf_state_key_ctor(void *, int, void *, int);
 static u_int32_t	 pf_tcp_iss(struct pf_pdesc *);
+void                     pf_rule_to_actions(struct pf_rule *,
+                            struct pf_rule_actions *);
 static int		 pf_test_rule(struct pf_rule **, struct pf_state **,
 			    int, struct pfi_kif *, struct mbuf *, int,
 			    struct pf_pdesc *, struct pf_rule **,
@@ -2821,6 +2823,15 @@ pf_addr_inc(struct pf_addr *addr, sa_family_t af)
 }
 #endif /* INET6 */
 
+void
+pf_rule_to_actions(struct pf_rule *r, struct pf_rule_actions *a)
+{
+        if (r->qid)
+                a->qid = r->qid;
+        if (r->pqid)
+                a->pqid = r->pqid;
+}
+
 int
 pf_socket_lookup(int direction, struct pf_pdesc *pd, struct mbuf *m)
 {
@@ -3343,10 +3354,20 @@ pf_test_rule(struct pf_rule **rm, struct pf_state **sm, int direction,
 			if (r->rtableid >= 0)
 				rtableid = r->rtableid;
 			if (r->anchor == NULL) {
-				match = 1;
-				*rm = r;
-				*am = a;
-				*rsm = ruleset;
+                                if (r->action == PF_MATCH) {
+                                        r->packets[direction == PF_OUT]++;
+                                        r->bytes[direction == PF_OUT] += pd->tot_len;
+                                        pf_rule_to_actions(r, &pd->act);
+                                        if (r->log)
+                                                PFLOG_PACKET(kif, m, af,
+                                                    direction, PFRES_MATCH, r,
+                                                    a, ruleset, pd, 1);
+                                } else {
+                                        match = 1;
+                                        *rm = r;
+                                        *am = a;
+                                        *rsm = ruleset;
+                                }
 				if ((*rm)->quick)
 					break;
 				r = TAILQ_NEXT(r, entries);
@@ -3365,6 +3386,9 @@ pf_test_rule(struct pf_rule **rm, struct pf_state **sm, int direction,
 
 	REASON_SET(&reason, PFRES_MATCH);
 
+        /* apply actions for last matching pass/block rule */
+        pf_rule_to_actions(r, &pd->act);
+
 	if (r->log || (nr != NULL && nr->log)) {
 		if (rewrite)
 			m_copyback(m, off, hdrlen, pd->hdr.any);
@@ -3538,6 +3562,9 @@ pf_create_state(struct pf_rule *r, struct pf_rule *nr, struct pf_rule *a,
 		s->state_flags |= PFSTATE_SLOPPY;
 	s->log = r->log & PF_LOG_ALL;
 	s->sync_state = PFSYNC_S_NONE;
+        s->qid = pd->act.qid;
+        s->pqid = pd->act.pqid;
+        s->state_flags |= pd->act.flags;	
 	if (nr != NULL)
 		s->log |= nr->log & PF_LOG_ALL;
 	switch (pd->proto) {
@@ -3796,10 +3823,20 @@ pf_test_fragment(struct pf_rule **rm, int direction, struct pfi_kif *kif,
 			r = TAILQ_NEXT(r, entries);
 		else {
 			if (r->anchor == NULL) {
-				match = 1;
-				*rm = r;
-				*am = a;
-				*rsm = ruleset;
+                                if (r->action == PF_MATCH) {
+                                         r->packets[direction == PF_OUT]++;
+                                         r->bytes[direction == PF_OUT] += pd->tot_len;
+                                         pf_rule_to_actions(r, &pd->act);
+                                         if (r->log)
+                                                 PFLOG_PACKET(kif, m, af,
+                                                     direction, PFRES_MATCH, r,
+                                                     a, ruleset, pd, 1);
+                                 } else {
+                                        match = 1;
+                                        *rm = r;
+                                        *am = a;
+                                        *rsm = ruleset;
+                                }
 				if ((*rm)->quick)
 					break;
 				r = TAILQ_NEXT(r, entries);
@@ -3818,6 +3855,9 @@ pf_test_fragment(struct pf_rule **rm, int direction, struct pfi_kif *kif,
 
 	REASON_SET(&reason, PFRES_MATCH);
 
+        /* apply actions for last matching pass/block rule */
+        pf_rule_to_actions(r, &pd->act);
+
 	if (r->log)
 		PFLOG_PACKET(kif, m, af, direction, reason, r, a, ruleset, pd,
 		    1);
diff --git a/sys/netpfil/pf/pf.h b/sys/netpfil/pf/pf.h
index 3a5d2aa46ec..f899fd2841c 100644
--- a/sys/netpfil/pf/pf.h
+++ b/sys/netpfil/pf/pf.h
@@ -45,7 +45,8 @@
 
 enum	{ PF_INOUT, PF_IN, PF_OUT, PF_FWD };
 enum	{ PF_PASS, PF_DROP, PF_SCRUB, PF_NOSCRUB, PF_NAT, PF_NONAT,
-	  PF_BINAT, PF_NOBINAT, PF_RDR, PF_NORDR, PF_SYNPROXY_DROP, PF_DEFER };
+	  PF_BINAT, PF_NOBINAT, PF_RDR, PF_NORDR, PF_SYNPROXY_DROP, PF_DEFER,
+          PF_MATCH };
 enum	{ PF_RULESET_SCRUB, PF_RULESET_FILTER, PF_RULESET_NAT,
 	  PF_RULESET_BINAT, PF_RULESET_RDR, PF_RULESET_MAX };
 enum	{ PF_OP_NONE, PF_OP_IRG, PF_OP_EQ, PF_OP_NE, PF_OP_LT,
diff --git a/sys/netpfil/pf/pf_ruleset.c b/sys/netpfil/pf/pf_ruleset.c
index 384e42bb8d8..227435998eb 100644
--- a/sys/netpfil/pf/pf_ruleset.c
+++ b/sys/netpfil/pf/pf_ruleset.c
@@ -120,6 +120,7 @@ pf_get_ruleset_number(u_int8_t action)
 		return (PF_RULESET_SCRUB);
 		break;
 	case PF_PASS:
+	case PF_MATCH:
 	case PF_DROP:
 		return (PF_RULESET_FILTER);
 		break;