Real incident on the staging host: nat on $ext_if from <subnet> to any -> ($ext_if) silently failed to rewrite the source IP when that IP was already aliased on the same interface, breaking all outbound jail traffic with no error anywhere - just clean timeouts. Fixed by using an explicit target IP instead of the interface macro. Cost real debugging time to trace from "WordPress admin hangs after a PHP upgrade" back to this. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>