pfSense

When you select any interface address in port forward entries now, it puts them into the config as something like:

                        <destination>
                                <network>opt1ip</network>
                                <port>80</port>
                        </destination>

Which results in an incorrect mask on the destination, it uses the interface's mask. Where you end up with:

rdr on em2 proto tcp from any to 6.4.1.13/29 port 80  -> 10.10.2.6

where it should be /32 not /29