With a line like this in npf.conf: | map pppoe0 dynamic 192.168.0.0/22 -> 1.2.3.4/32 npfctl validate says: | /etc/npf.conf:5:0: translation address, given the specified algorithm, must be a pool or a single address while this: | map pppoe0 dynamic 192.168.0.0/22 -> 1.2.3.4 validates okay.