pfSense

Aliases are allowed to be used in several ways that breaks the ruleset.

firewall_nat_edit.php needs a check to only allow a single IP host alias. firewall_aliases_edit.php needs a check to not allow adding IPs to an alias used in a port forward entry.

Host and network aliases can be entered in the Port box, and port aliases in the src/dst boxes. They don't show up in autocompletion, but are used if name is typed in manually, breaking the ruleset.