Sorry, reposted with mutt... for some reason, thunderbird replaced tabs with 4
spaces.

$rulelist = $config['filter']['rule'];
foreach ($rulelist as $rule) {
    if (isset($rule['disabled'])) {
	splice($rulelist,key($rulelist),1);
	prev($rulelist);
	continue;
    }

    if ($rule['type']     == 'reject' &&
	$rule['protocol'] == 'tcp/udp') {

	$ruleTCP = $rule;
	$ruleTCP['protocol'] = 'tcp';
	$ruleUDP = $rule;
	$ruleTCP['protocol'] = 'udp';

	splice($rulelist,key($rulelist),1,array($ruleTCP,$ruleUDP));
	prev($rulelist);
	continue;
    }

    if (isset($rule['natmap'])) {
	$natmap = $rule['natmap'];
	$natmaprule = 0; // Not sure about scoping in PHP...
	foreach ($config['nat']['rule'] as $natrule) {
	    if ($natrule['ruleid'] == $natmap) {
		$natmaprule = $natrule;
		break;
	    }
	}
	unset($rule['natmap']);
	$rule['interface']   = $natmaprule['interface'];
	$rule['protocol']    = $natmaprule['protocol'];
	$rule['destination'] = array('address' => $natmaprule['target'],
				     'port'    => $natmaprule['local-port']);
	$rulelist[key($rulelist)] = $rule;
	prev($rulelist);
	continue;
    }
}
foreach ($rulelist as $rule) {
    // spit out ipf ruleset
    ...
}