After some more time with the problem, I switched my approach to 
bridge(4) and vether(4).  All the configs are basically the same and
now I can send traffic from the host through the vether(4) interface
and all my pf rules work (after replacing vport w vether in pf.conf).

Is this the expected behavior for veb(4)? Either you get to filter the 
veb traffic OR you get to put a vport on the veb?

I'm having a really hard time grocking the veb link1 behavior.


On 3/16/26 7:51 PM, Isaac Meerleo wrote:
> I am trying to create a sort of managed switch out of my OpenBSD box.