Mit BastilleBSD und PF Portweiterleitung in Jail funktioniert nicht

[carbuncle]

Moin,

ich bin gerade dabei nginx in eine BastilleBSD Jail unter 15.1-RELEASE zu packen. Soweit funktioniert auch alles bis auf das Redirect von Port 80.

Meine pf.conf auf dem Host:

# Bastille firewall configuration - start
ext_if="vtnet0"

icmp6_types = "{ echoreq, neighbradv, neighbrsol, routeradv, routersol }"

set block-policy return
scrub in on $ext_if all fragment reassemble
set skip on lo0

table <jails> persist
nat on $ext_if from <jails> to any -> ($ext_if:0)
rdr-anchor "rdr/*"

block in all
pass out quick keep state
antispoof for $ext_if

anchor "bastille/*"

#Allow IPv4 ping
pass in on $ext_if inet proto icmp icmp-type { echoreq, unreach }

# Allow IPv6 ping
pass in quick on $ext_if inet6 proto icmp6 all icmp6-type $icmp6_types allow-opts
pass out quick on $ext_if inet6 proto icmp6 all icmp6-type $icmp6_types allow-opts

pass in proto tcp from any to any port ssh flags S/SA keep state
## Bastille firewall configuration - end

Das aktuelle pf ruleset sieht so aus:

# pfctl -sr

scrub in on vtnet0 all fragment reassemble
block return in all
pass out quick all flags S/SA keep state
block drop in on ! vtnet0 inet6 from 2a03:4000:1c:42f::/64 to any
block drop in on vtnet0 inet6 from fe80::a85b:cdff:fe9c:f972 to any
block drop in inet6 from 2a03:4000:1c:42f:a85b:cdff:fe9c:f972 to any
block drop in inet6 from 2a03:4000:1c:42f::10 to any
block drop in on ! vtnet0 inet from 185.194.140.0/22 to any
block drop in inet from 185.194.141.169 to any
anchor "bastille/*" all
pass in on vtnet0 inet proto icmp all icmp-type echoreq keep state
pass in on vtnet0 inet proto icmp all icmp-type unreach keep state
pass in quick on vtnet0 inet6 proto ipv6-icmp all icmp6-type echoreq keep state allow-opts
pass in quick on vtnet0 inet6 proto ipv6-icmp all icmp6-type neighbradv keep state allow-opts
pass in quick on vtnet0 inet6 proto ipv6-icmp all icmp6-type neighbrsol keep state allow-opts
pass in quick on vtnet0 inet6 proto ipv6-icmp all icmp6-type routeradv keep state allow-opts
pass in quick on vtnet0 inet6 proto ipv6-icmp all icmp6-type routersol keep state allow-opts
pass out quick on vtnet0 inet6 proto ipv6-icmp all icmp6-type echoreq keep state allow-opts
pass out quick on vtnet0 inet6 proto ipv6-icmp all icmp6-type neighbradv keep state allow-opts
pass out quick on vtnet0 inet6 proto ipv6-icmp all icmp6-type neighbrsol keep state allow-opts
pass out quick on vtnet0 inet6 proto ipv6-icmp all icmp6-type routeradv keep state allow-opts
pass out quick on vtnet0 inet6 proto ipv6-icmp all icmp6-type routersol keep state allow-opts
pass in proto tcp from any to any port = ssh flags S/SA keep state

Das spezifische bastilleBSD ruleset bleibt dagegen leer:

# pfctl -a "bastille/*" -sr

bastilleBSD sagt dazu folgendes was auch ziemlich schlüssig aussieht:

# bastille rdr nginx list
rdr on vtnet0 inet proto tcp from any to any port = 80 -> XXX.XXX.XXX.XXX port 80
rdr on vtnet0 inet6 proto tcp from any to any port = 80 -> 1234:1234:1:100::10 port 80
pass in on vtnet0 inet proto tcp from any to 10.0.0.10 port = 80 flags S/SA keep state
pass in on vtnet0 inet6 proto tcp from any to 1234:1234:1:100::10 port = 80 flags S/SA keep state

Ich habe die Vermutung dass die Firewallregeln von bastilleBSD zur Laufzeit zwar erzeugt werden, jedoch nicht an pf übergeben werden. Man würde ja sonst bei "pfctl -a "bastille/*" -sr" was sehen.

Weiss jemand was ich übersehe?

Vielen Dank schonmal.