ANSWER:

Make sure that the client interfaces are able to ping 192.65.214.131 as well as the server running pf, and that 192.65.214.131 is able to ping the client machines (or if ping is disabled for some reason, just make sure they have a route that works). One really common issue with these setups is that the packet can get to the host with the NAT’s help, but if the NAT has only changed the destination address and not the source, or if it is intended only to redirect but the routing table doesn’t show the way back, the packets can go only one way and you have an asymmetric routing failure.

by Falcon Kirtaran from http://serverfault.com/questions/385109