# on network 3.0
pass in quick on $iface_dmz3 proto tcp from $srv_client1 to $srv_db1 port $port_mysql tag tag_z3_to_z1 keep state label "client1_dmz1_mysql"

# On target (1.0)
pass out quick on $iface_dmz1 tagged tag_z3_to_z1 keep state label "tag_z3_to_z1"
block in  log quick on $iface_dmz1 label "dmz1_block_in"
block out log quick on $iface_dmz1 label "dmz1_block_out"

-------------

Most of time, everything is fine, but, sometimes I got : 
 
May 30 15:38:21.499664 rule 46/(match) block in on em3: 192.168.1.1.3306 > 192.168.3.1.33874: [|tcp] (DF)
May 30 15:40:19.897848 rule 46/(match) block in on em3: 192.168.1.1.3306 > 192.168.3.1.36140: [|tcp] (DF)

Am I loosing some tags ?