diff --git a/build_num b/build_num
index 6b2c5add5..71e88a104 100644
--- a/build_num
+++ b/build_num
@@ -1 +1 @@
-#define BUILD_NUM 791
+#define BUILD_NUM 792
diff --git a/doc/ChangeLog b/doc/ChangeLog
index 2c5485e67..c6a954ef1 100644
--- a/doc/ChangeLog
+++ b/doc/ChangeLog
@@ -1,3 +1,15 @@
+2009-03-25  vadim  <vadim@vk.crocodile.org>
+
+	* NATCompiler_pf_writers.cpp (PrintRule::_printPort): fixed bug
+	#2712514: "Bug in PF NAT Writer - 'tagged' keyword". Keyword
+	'tagged' is only allowed on the left hand side of '->' in nat
+	and rdr rules.
+
+	* RuleElement.cpp (RuleElementTSrv::validateChild): (change in
+	libfwbuilder) fixed bug #2712575: "NAT RuleSetView allows
+	TagService to be in Translated Svc". TagService object should not
+	be allowed in "Translated Service" in NAT rules.
+
 2009-03-24  vadim  <vadim@vk.crocodile.org>
 
 	* DialogData.cpp (DialogData::loadToWidget): fixed bug #2710309:
diff --git a/src/pflib/NATCompiler_pf.h b/src/pflib/NATCompiler_pf.h
index 851918437..7cf27cd91 100644
--- a/src/pflib/NATCompiler_pf.h
+++ b/src/pflib/NATCompiler_pf.h
@@ -343,7 +343,8 @@ namespace fwcompiler {
             std::string                      current_rule_label;
 
             virtual void _printProtocol(libfwbuilder::Service *srv);
-            virtual void _printPort(libfwbuilder::Service *srv,bool print_range_end);
+            virtual void _printPort(libfwbuilder::Service *srv,
+                                    bool lhs);
 
             virtual void _printAddrList(libfwbuilder::FWObject  *o,bool negflag);
             virtual void _printREAddr(libfwbuilder::RuleElement *o);
diff --git a/src/pflib/NATCompiler_pf_writers.cpp b/src/pflib/NATCompiler_pf_writers.cpp
index a1909e460..c73efa14d 100644
--- a/src/pflib/NATCompiler_pf_writers.cpp
+++ b/src/pflib/NATCompiler_pf_writers.cpp
@@ -249,7 +249,16 @@ void NATCompiler_pf::PrintRule::_printProtocol(Service *srv)
     }
 }
 
-void NATCompiler_pf::PrintRule::_printPort(Service *srv, bool print_range_end)
+/*
+ * print port numbers for the service. For most platforms that inherit
+ * classes for PF this is sufficient, but PF itself also supports
+ * TagService and this method prints "tagged" keyword for it as well.
+ * Arg <lhs> controls which side of the "->" this service is on.  On
+ * the right hand side PF supports shortcut spec 'NNNN:*', but it is
+ * not allowed on the left hand side. Also keyword "tagged" is only
+ * allowed on the left hand side of "->".
+ */
+void NATCompiler_pf::PrintRule::_printPort(Service *srv, bool lhs)
 {
     if (TCPService::isA(srv) || UDPService::isA(srv))
     {
@@ -260,7 +269,7 @@ void NATCompiler_pf::PrintRule::_printPort(Service *srv, bool print_range_end)
             compiler->output << "port " << drs;
             if (dre!=0 && dre!=drs)
             {
-                if (print_range_end)
+                if (lhs)
                     compiler->output << ":" << dre;
                 else
                     compiler->output << ":*";
@@ -268,7 +277,8 @@ void NATCompiler_pf::PrintRule::_printPort(Service *srv, bool print_range_end)
         }
         compiler->output  << " ";
     }
-    if (TagService::isA(srv)) 
+
+    if (lhs && TagService::isA(srv)) 
     {
 	compiler->output << "tagged "
                          << TagService::constcast(srv)->getCode() << " ";