On Mon, Jun 23, 2014 at 01:42:37PM +0200, Christoph Kaegi wrote: > > $EXTIF = ifnet(vr0) I'd say inet4() or inet6(), not ifnet(). > pass stateful in final family inet proto tcp to $EXTIF port ssh inet4/inet6 instead of inet.