bubbleb74I finally came around to give <a href="https://snac.doosom.com?t=bastillebsd" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#BastilleBSD</a> a try on a <a href="https://snac.doosom.com?t=freebsd" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FreeBSD</a> test system but I struggle with the rdr rules. I always get the following error when starting the vnet jail:<br><br>stdin:2: syntax error<br>pfctl: Syntax error in config file: pf rules not loaded<br><br>Here my pf.conf<br><br><pre>lo_if="lo1"<br>ext_if="vmx0"<br>jail_if="vmx0bridge"<br><br><a href="https://snac.doosom.com?t=set" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#set</a> block-policy return<br>scrub in on $ext_if all fragment reassemble<br>set skip on lo<br>set skip on $jail_if<br><br>table &lt;jails&gt; persist<br>nat on $ext_if from &lt;jails&gt; to any -&gt; ($ext_if:0)<br><a href="https://snac.doosom.com?t=nat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nat</a> on $ext_if from $jail_if:network to any -&gt; ($ext_if)<br><a href="https://snac.doosom.com?t=nat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nat</a> on $jail_if from $jail_if:network to any -&gt; ($jail_if)<br><a href="https://snac.doosom.com?t=nat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nat</a> on $lo_if from $jail_if:network to any -&gt; ($lo_if)<br>rdr-anchor "rdr/*"<br><br><a href="https://snac.doosom.com?t=block" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#block</a> in all<br>pass out quick keep state<br><a href="https://snac.doosom.com?t=antispoof" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#antispoof</a> for $ext_if inet<br>pass in inet proto tcp from any to any port ssh flags S/SA keep state<br>pass in on $ext_if inet proto icmp to ($ext_if) icmp-type { unreach, redir, timex, echoreq }<br>pass in on $ext_if inet proto icmp to ($jail_if) icmp-type { unreach, redir, timex, echoreq }<br>pass in on $jail_if inet proto icmp to $jail_if:network icmp-type { unreach, redir, timex, echoreq }<br></pre><br>My BastilleBSD version is 0.13.20250126<br>