I'm not familiar with the pf "tag", and I gtg so I don't have time to read more, but it seems very similar to "mark"[1]. It essentially lets you mark a packet with a tag (if memory serves it's a 32 bitmap you can do whatever bitwise/assignment operations to). I used it in the beginning, but then I managed to find cleaner ways to do what I was doing.

For me nftables changed the game for linux firewalls. From the almost incomprehensible mess that was iptables we now have a clean language that lets me be quite DRY, and is easy to work with.

1: https://wiki.nftables.org/wiki-nftables/index.php/Setting_pa...