Can't answer the first question, but for me the pf syntax for firewall rules, NAT and inbound port forwarding is much simpler. I don't trust any box running 30

Can't answer the first question, but for me the pf syntax for firewall rules, NAT and inbound port forwarding is much simpler. I don't trust any box running 300 out-of-date packages plus a PHP GUI, so my edge device is simply a dual-ethernet 8W device that runs OpenBSD with the following rules: set skip on lo0 block all pass out on en0 inet from en1:network to any nat-to (en0) // source NAT