pf config to isolate two vnet/netgraph VLAN jail groups?

Hi, Any suggestion to restrict any transaction/interaction/traffic between NATted netgraph vlans (vi0 and vi1) in this case, but not with the bridged external nic ($ext_if in pf) in a setup (digraph) as of below (netdiagram is attached). I appreciate if anyone can suggest some inputs to isolate

[Bug 254171] 13.0-RC1: pf: vnet: jail leaves a unnecessary swi1 thread in intr process

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=254171 Kristof Provost changed: What|Removed |Added Status|New |In Progress

[Bug 254171] 13.0-RC1: pf: vnet: jail leaves a unnecessary swi1 thread in intr process

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=254171 Mark Linimon changed: What|Removed |Added Assignee|b...@freebsd.org|p...@freebsd.org -- You are

Re: pfctl segmentation fault in pfctl_optimize.c

On 9 Mar 2021, at 11:05, Patrick Lamaiziere wrote: Hello, FreeBSD 11.4-RELEASE-p3 / amd64 Yesterday while loading a ruleset, pfctl core dumped with a segmentation fault (see gdb below) We are recently using some big tables so may be this is what triggered the problem (?), i can't reproduce

load balancing port redirects

Is there any way in pf to redirect one port to a range of ports ? e.g rdr pass log on $public_nic proto tcp from any  to $public_nat_ip port 80 -> $web_server port 80:100 Much like round robin load balancing on outbound nat, I want to round robin through ports if possible.     ---Mike