diff --git a/docs/chapters/networking.rst b/docs/chapters/networking.rst
index d94bf27d7..8b78b5dbb 100644
--- a/docs/chapters/networking.rst
+++ b/docs/chapters/networking.rst
@@ -120,6 +120,10 @@ container interfaces as they are started and stopped. These interface names
 match the pattern `eXb_bastilleX`. Internally to the containers these
 interfaces are presented as `vnet0`.
 
+If you do not specify a subnet mask, you might have issues with jail to jail
+networking, especially VLAN to VLAN. We recommend always adding a subnet to
+VNET jail IPs when creating them to avoid these issues.
+
 VNET also requires a custom devfs ruleset. Create the file as needed on the
 host system:
 
@@ -305,3 +309,21 @@ At this point you'll likely be disconnected from the host. Reconnect the
 ssh session and continue.
 
 This step only needs to be done once in order to prepare the host.
+
+local_unbound
+=============
+
+If you are running "local_unbound" on your server, you will probably have issues with DNS resolution.
+
+To resolve this, add the following configuration to local_unbound:
+
+.. code-block:: shell
+
+  server:
+  interface: 0.0.0.0
+  access-control: 192.168.0.0/16 allow
+  access-control: 10.17.90.0/24 allow
+
+Also, change the nameserver to the servers IP instead of 127.0.0.1 inside /etc/rc.conf
+
+Adjust the above "access-control" strings to fit your network.
diff --git a/docs/chapters/subcommands/etcupdate.rst b/docs/chapters/subcommands/etcupdate.rst
new file mode 100644
index 000000000..cec9a4113
--- /dev/null
+++ b/docs/chapters/subcommands/etcupdate.rst
@@ -0,0 +1,46 @@
+=========
+etcupdate
+=========
+
+This command will update the contents of `/etc` inside a jail. It should be run after a jail upgrade
+
+First we need to bootstrap a release for `etcupdate` to use.
+
+.. code-block:: shell
+
+  ishmael ~ # bastille etcupdate bootstrap 14.1-RELEASE
+  bastille_bootstrap_archives: base -> src
+  /usr/local/bastille/cache/14.1-RELEASE/MANIFES        1046  B 1134 kBps    00s
+  /usr/local/bastille/cache/14.1-RELEASE/src.txz         205 MB 2711 kBps 01m18s
+  bastille_bootstrap_archives: src -> base
+  Building tarball, please wait...
+  Etcupdate bootstrap complete: 14.1-RELEASE
+
+Next we can use the `update` command to apply the update to the jail.
+
+.. code-block:: shell
+
+  ishmael ~ # bastille etcupdate ishmael update 14.1-RELEASE
+
+The output will show you which files were added, updated, changed, deleted, or have conflicts.
+To automatically resolve the conflicts, run the `resolve` command.
+            
+.. code-block:: shell
+
+  ishmael ~ # bastille etcupdate ishmael resolve
+
+To show only the differences between the releases, use the `diff` command.
+
+.. code-block:: shell
+
+  ishmael ~ # bastille etcupdate ishmael diff 14.1-RELEASE
+
+.. code-block:: shell
+
+  ishmael ~ # bastille etcupdate help
+  Usage: bastille etcupdate [option(s)] [bootstrap|TARGET] [diff|resolve|update RELEASE]
+    Options:
+
+    -d | --dry-run          Show output, but do not apply.
+    -f | --force            Force a re-bootstrap of a RELEASE.
+    -x | --debug            Enable debug mode.
diff --git a/docs/chapters/subcommands/rdr.rst b/docs/chapters/subcommands/rdr.rst
index a65375a2c..262f83b89 100644
--- a/docs/chapters/subcommands/rdr.rst
+++ b/docs/chapters/subcommands/rdr.rst
@@ -14,13 +14,67 @@ specify the interface they run on in rc.conf (or other config files)
 .. code-block:: shell
 
     # bastille rdr --help
-    Usage: bastille rdr TARGET [clear] | [list] | [tcp <host_port> <jail_port>] | [udp <host_port> <jail_port>]
+    Usage: bastille rdr TARGET [option(s)] [clear|reset|list|(tcp|udp host_port jail_port [log ['(' logopts ')'] ] )]
+    Options:
+
+    -i | --interface   [interface]               Set the interface to create the rdr rule on. Useful if you have multiple interfaces.
+    -s | --source      [source ip]               Limit rdr to a source IP. Useful to only allow access from a certian IP or subnet.
+    -d | --destination [destination ip]          Limit rdr to a destination IP. Useful if you have multiple IPs on one interface.
+    -t | --type        [ipv4|ipv6]               Specify IP type. Must be used if -s or -d are used. Defaults to both.
+    -x | --debug                                 Enable debug mode.
+    
     # bastille rdr dev1 tcp 2001 22
+    [jail1]:
+    IPv4 tcp/2001:22  on em0
+   
     # bastille rdr dev1 list
     rdr on em0 inet proto tcp from any to any port = 2001 -> 10.17.89.1 port 22
+    
     # bastille rdr dev1 udp 2053 53
+    [jail1]:
+    IPv4 udp/2053:53 on em0
+    
     # bastille rdr dev1 list
-    rdr on em0 inet proto tcp from any to any port = 2001 -> 10.17.89.1 port 22
-    rdr on em0 inet proto udp from any to any port = 2053 -> 10.17.89.1 port 53
+    rdr pass on em0 inet proto tcp from any to any port = 2001 -> 10.17.89.1 port 22
+    rdr pass on em0 inet proto udp from any to any port = 2053 -> 10.17.89.1 port 53
+    
     # bastille rdr dev1 clear
     nat cleared
+
+The `rdr` command includes 4 additional options:
+
+.. code-block:: shell
+
+    -i | --interface   [interface]               Set the interface to create the rdr rule on. Useful if you have multiple interfaces.
+    -s | --source      [source ip]               Limit rdr to a source IP. Useful to only allow access from a certian IP or subnet.
+    -d | --destination [destination ip]          Limit rdr to a destination IP. Useful if you have multiple IPs on one interface.
+    -t | --type        [ipv4|ipv6]               Specify IP type. Must be used if -s or -d are used. Defaults to both.
+
+.. code-block:: shell
+
+    # bastille rdr dev1 -i vtnet0 udp 8000 80
+    [jail1]:
+    IPv4 tcp/8000:80 on vtnet0
+    
+    # bastille rdr dev1 -s 192.168.0.1 tcp 8080 81
+    [jail1]:
+    IPv4 tcp/8080:81 on em0
+
+    # bastille rdr dev1 -d 192.168.0.84 tcp 8082 82
+    [jail1]:
+    IPv4 tcp/8082:82 on em0
+
+    # bastille rdr dev1 -i vtnet0 -d 192.168.0.45 tcp 9000 9000
+    [jail1]:
+    IPv4 tcp/9000:9000 on vtnet0
+
+    # bastille rdr dev1 list
+    rdr pass on vtnet0 inet proto udp from any to any port = 2001 -> 10.17.89.1 port 22
+    rdr pass on em0 inet proto tcp from 192.168.0.1 to any port = 8080 -> 10.17.89.1 port 81
+    rdr pass on em0 inet proto tcp from any to 192.168.0.84 port = 8082 -> 10.17.89.1 port 82
+    rdr pass on vtnet0 inet proto tcp from any to 192.168.0.45 port = 9000 -> 10.17.89.1 port 9000
+
+The options can be used together, as seen above.
+
+If you have multiple interfaces assigned to your jail, `bastille rdr` will
+only redirect using the default one.
diff --git a/docs/chapters/subcommands/update.rst b/docs/chapters/subcommands/update.rst
index 4beef6557..e1a6bae47 100644
--- a/docs/chapters/subcommands/update.rst
+++ b/docs/chapters/subcommands/update.rst
@@ -2,8 +2,8 @@
 update
 ======
 
-The `update` command targets a release instead of a container. Because every container is
-based on a release, when the release is updated all the containers are automatically
+The `update` command targets a release or a thick jail. Because thin jails are
+based on a release, when the release is updated all the thin jails are automatically
 updated as well.
 
 If no updates are available, a message will be shown:
@@ -20,8 +20,7 @@ If no updates are available, a message will be shown:
   No updates needed to update system to 11.4-RELEASE-p4.
   No updates are available to install.
 
-
-The older the release, however, the more updates will be available:
+The older the release or jail, however, the more updates will be available:
 
 .. code-block:: shell
 
@@ -38,4 +37,7 @@ The older the release, however, the more updates will be available:
   The following files will be added as part of updating to 13.2-RELEASE-p4:
   ...[snip]...
 
-To be safe, you may want to restart any containers that have been updated live.
+To be safe, you may want to restart any jails that have been updated live.
+
+If the jail is a thin jail, an error will be shown. If it is a thick jail, it will be updated just like
+the release shown above.
diff --git a/docs/chapters/subcommands/upgrade.rst b/docs/chapters/subcommands/upgrade.rst
new file mode 100644
index 000000000..bbff8af46
--- /dev/null
+++ b/docs/chapters/subcommands/upgrade.rst
@@ -0,0 +1,16 @@
+=======
+upgrade
+=======
+
+The `upgrade` command targets a thick or thin jail. Thin jails will be updated by changing the
+release mount point that it is based on. Thick jails will be upgraded normally.
+
+.. code-block:: shell
+
+  ishmael ~ # bastille upgrade help
+  Usage: bastille upgrade [option(s)] TARGET [NEWRELEASE|install]
+    Options:
+
+    -a | --auto             Auto mode. Start/stop jail(s) if required.
+    -f | --force            Force upgrade a jail.
+    -x | --debug            Enable debug mode.
diff --git a/docs/chapters/template.rst b/docs/chapters/template.rst
index e3a7d5f1a..0c45bead5 100644
--- a/docs/chapters/template.rst
+++ b/docs/chapters/template.rst
@@ -6,8 +6,8 @@ Looking for ready made CI/CD validated `Bastille Templates`_?
 Bastille supports a templating system allowing you to apply files, pkgs and
 execute commands inside the containers automatically.
 
-Currently supported template hooks are: `CMD`, `CP`, `INCLUDE`, `LIMITS`, `MOUNT`,
-`PKG`, `RDR`, `SERVICE`, `SYSRC`.
+Currently supported template hooks are: `ARG`, `CMD`, `CONFIG`, `CP`, `INCLUDE`,
+`LIMITS`, `MOUNT`, `OVERLAY`, `PKG`, `RDR`, `RENDER`, `RESTART`, `SERVICE`, `SYSRC`.
 
 Templates are created in `${bastille_prefix}/templates` and can leverage any of
 the template hooks.
@@ -23,27 +23,75 @@ template hook commands.
 Template Automation Hooks
 -------------------------
 
-+---------+-------------------+-----------------------------------------+
-| HOOK    | format            | example                                 |
-+=========+===================+=========================================+
-| CMD     | /bin/sh command   | /usr/bin/chsh -s /usr/local/bin/zsh     |
-+---------+-------------------+-----------------------------------------+
-| CP      | path(s)           | etc root usr (one per line)             |
-+---------+-------------------+-----------------------------------------+
-| INCLUDE | template path/URL | http?://TEMPLATE_URL or project/path    |
-+---------+-------------------+-----------------------------------------+
-| LIMITS  | resource value    | memoryuse 1G                            |
-+---------+-------------------+-----------------------------------------+
-| MOUNT   | fstab syntax      | /host/path container/path nullfs ro 0 0 |
-+---------+-------------------+-----------------------------------------+
-| PKG     | port/pkg name(s)  | vim-console zsh git-lite tree htop      |
-+---------+-------------------+-----------------------------------------+
-| RDR     | tcp port port     | tcp 2200 22 (hostport jailport)         |
-+---------+-------------------+-----------------------------------------+
-| SERVICE | service command   | 'nginx start' OR 'postfix reload'       |
-+---------+-------------------+-----------------------------------------+
-| SYSRC   | sysrc command(s)  | nginx_enable=YES                        |
-+---------+-------------------+-----------------------------------------+
++-------------+---------------------+-----------------------------------------+
+| HOOK        | format              | example                                 |
++=============+=====================+=========================================+
+| ARG         | ARG=VALUE           | MINECRAFT_MEMX="1024M"                  |
++-------------+---------------------+-----------------------------------------+
+| CMD         | /bin/sh command     | /usr/bin/chsh -s /usr/local/bin/zsh     |
++-------------+---------------------+-----------------------------------------+
+| CONFIG      | set property value  | set allow.mlock 1                       |
++-------------+---------------------+-----------------------------------------+
+| CP/OVERLAY  | path(s)             | etc root usr (one per line)             |
++-------------+---------------------+-----------------------------------------+
+| INCLUDE     | template path/URL   | http?://TEMPLATE_URL or project/path    |
++-------------+---------------------+-----------------------------------------+
+| LIMITS      | resource value      | memoryuse 1G                            |
++-------------+---------------------+-----------------------------------------+
+| MOUNT       | fstab syntax        | /host/path container/path nullfs ro 0 0 |
++-------------+---------------------+-----------------------------------------+
+| OVERLAY     | path(s)             | etc root usr (one per line)             |
++-------------+---------------------+-----------------------------------------+
+| PKG         | port/pkg name(s)    | vim-console zsh git-lite tree htop      |
++-------------+---------------------+-----------------------------------------+
+| RDR         | tcp port port       | tcp 2200 22 (hostport jailport)         |
++-------------+---------------------+-----------------------------------------+
+| RENDER      | /path/file.txt      | /usr/local/etc/gitea/conf/app.ini       |
++-------------+---------------------+-----------------------------------------+
+| RESTART     |                     | (restart jail)                          |
++-------------+---------------------+-----------------------------------------+
+| SERVICE     | service command     | 'nginx start' OR 'postfix reload'       |
++-------------+---------------------+-----------------------------------------+
+| SYSRC       | sysrc command(s)    | nginx_enable=YES                        |
++-------------+---------------------+-----------------------------------------+
+
+Template Hook Descriptions
+--------------------------
+
+ARG         - set an ARG value to be used in the template
+
+ARGS will default to the value set inside the template, but can be changed by including `--arg ARG=VALUE` when
+running the template. Multiple ARGS can also be specified as seen below. If no ARG value is given, the template 
+will show a warning, but will still continue.
+
+.. code-block:: shell
+
+  ishmael ~ # bastille template azkaban sample/template --arg ARG=VALUE --arg ARG1=VALUE
+
+
+CMD         - run the specified command
+
+CONFIG      - set the specified property and value
+
+CP/OVERLAY  - copy specified files from template directory to specified path inside jail
+
+INCLUDE     - specify a template to include. Make sure the template is bootstrapped, or you are using the template url
+
+LIMITS      - set the specified resource value for the jail
+
+MOUNT       - mount specified files/directories inside the jail
+
+PKG         - install specified packages inside jail
+
+RDR         - redirect specified ports to the jail
+
+RENDER      - replace ARG values inside specified files inside the jail. If a directory is specified, ARGS will be replaced in all files underneath
+
+RESTART     - restart the jail
+
+SERVICE     - run `service` command inside the jail with specified arguments
+
+SYSRC       - run `sysrc` inside the jail with specified arguments
 
 Special Hook Cases
 ------------------
@@ -54,6 +102,9 @@ ie; (`\\"`)
 ARG will always treat an ampersand "\&" literally, without the need to escape it.
 Escaping it will cause errors.
 
+Template Examples
+-----------------
+
 Place these uppercase template hook commands into a `Bastillefile` in any order
 and automate container setup as needed.
 
diff --git a/docs/chapters/upgrading.rst b/docs/chapters/upgrading.rst
index b059fa0d0..1d9161eb6 100644
--- a/docs/chapters/upgrading.rst
+++ b/docs/chapters/upgrading.rst
@@ -5,31 +5,88 @@ This document outlines upgrading jails hosted using Bastille.
 
 Bastille can "bootstrap" multiple versions of FreeBSD to be used by jails. All jails do not NEED to be the same version (even if they often are), the only requirement here is that the "bootstrapped" versions are less than or equal to the host version of FreeBSD.
 
+To keep releases updated, use `bastille update RELEASE`
+
+To keep thick jails updated, use `bastille update TARGET`
+
+======================
+Minor Release Upgrades
+======================
+
 To upgrade Bastille jails for a minor release (ie; 13.1→13.2) you can do the following:
 
-1. ensure the new release version is bootstrapped and updated to the latest patch release: `bastille bootstrap 13.2-RELEASE update`
-2. stop the jail(s) that need to be updated.
-3. use `bastille edit TARGET fstab` to manually update the jail mounts from 13.1 to 13.2 release path.
-4. start the jail(s) that were edited
-5. upgrade complete!
+Thick Jails
+===========
+
+1. ensure the new release version is bootstrapped and updated to the latest patch release: `bastille bootstrap 13.2-RELEASE`
+2. update the release: `bastille update 13.2-RELEASE`
+3. use `bastille upgrade TARGET 13.2-RELEASE` to upgrade the jail to 13.2-RELEASE
+4. use `bastille upgrade TARGET 13.2-RELEASE update` to apply the updates
+5. reboot the jail `bastille restart TARGET`
+6. use `bastille upgrade TARGET 13.2-RELEASE update` to finish applying the upgrade
+7. upgrade complete!
+
+Thin Jails
+==========
+
+1. ensure the new release version is bootstrapped and updated to the latest patch release: `bastille bootstrap 13.2-RELEASE`
+2. update the release: `bastille update 13.2-RELEASE`
+3. stop the jail(s) that need to be updated.
+4. use `bastille upgrade TARGET 13.2-RELEASE` to automatically change the mount points to 13.2-RELEASE
+5. use `bastille etcupdate bootstrap 13.2-RELEASE` to bootstrap src for 13.2-RELEASE
+6. use `bastille etcupdate TARGET update 13.2-RELEASE` to update the contents of /etc for 13.2-RELEASE
+7. use `bastille etcupdate TARGET reslove` to resolve any conflicts
+8. start the jail(s)
+8. upgrade complete!
+
+======================
+Major Release Upgrades
+======================
 
 To upgrade Bastille jails for a major release (ie; 12.4→13.2) you can do the following:
 
-1. ensure the new version is bootstrapped and update to the latest patch release: `bastille bootstrap 13.2-RELEASE update`
-2. stop the jail(s) that need to be updated.
-3. use `bastille edit TARGET fstab` to manually update the jail mounts from 12.4 to 13.2 release path.
-4. start the jail(s) that were edited
-5. Force the reinstallation or upgrade of all installed packages (ABI change): `pkg upgrade -f` within each jail (or `bastille pkg ALL upgrade -f`)
-6. restart the affected jail(s)
-7. upgrade complete!
+Thick Jails
+===========
+
+1. ensure the new release version is bootstrapped and updated to the latest patch release: `bastille bootstrap 13.2-RELEASE`
+2. update the release: `bastille update 13.2-RELEASE`
+3. use `bastille upgrade TARGET 13.2-RELEASE` to upgrade the jail to 13.2-RELEASE
+4. use `bastille upgrade TARGET 13.2-RELEASE update` to apply the updates
+5. reboot the jail `bastille restart TARGET`
+6. use `bastille upgrade TARGET 13.2-RELEASE update` to finish applying the upgrade
+7. force the reinstallation or upgrade of all installed packages (ABI change): `pkg upgrade -f` within each jail (or `bastille pkg ALL upgrade -f`)
+8. upgrade complete!
+
+Thin Jails
+==========
+
+1. ensure the new release version is bootstrapped and updated to the latest patch release: `bastille bootstrap 13.2-RELEASE`
+2. update the release: `bastille update 13.2-RELEASE`
+3. stop the jail(s) that need to be updated.
+4. use `bastille upgrade TARGET 13.2-RELEASE` to automatically change the mount points to 13.2-RELEASE
+5. use `bastille etcupdate bootstrap 13.2-RELEASE` to bootstrap src for 13.2-RELEASE
+6. use `bastille etcupdate TARGET update 13.2-RELEASE` to update the contents of /etc for 13.2-RELEASE
+7. use `bastille etcupdate TARGET reslove` to resolve any conflicts
+8. start the jail(s)
+9. force the reinstallation or upgrade of all installed packages (ABI change): `pkg upgrade -f` within each jail (or `bastille pkg ALL upgrade -f`)
+10. upgrade complete!
 
 Revert Upgrade / Downgrade Process
 ----------------------------------
 The downgrade process (not usually needed) is similar to the upgrade process only in reverse.
 
-If you did a minor upgrade changing the release path from 13.1 to 13.2, stop the jail and revert that change. Downgrade complete.
+Thick Jails
+===========
+
+Thick jails should not be downgraded and is not supported in general on FreeBSD.
+
+Thin Jails
+==========
+
+Not recommended, but you can run `bastille upgrade TARGET 13.1-RELEASE` to downgrade a thin jail.
+Make sure to run `bastille etcupdate TARGET update 13.1-RELEASE` to keep the contents of /etc updated with each release.
 
-If you did a major upgrade changing the release path from 12.4 to 13.2, stop the jail and revert that change. The pkg reinstallation will also need to be repeated after the jail restarts on the previous release.
+The pkg reinstallation will also need to be repeated after the jail restarts on the previous release.
 
 Old Releases
 ----------------------------------
@@ -40,4 +97,4 @@ After upgrading all jails from one release to the next you may find that you now
 
 `bastille destroy X.Y-RELEASE` to fully delete the release.
 
-`bastille destroy force X.Y-RELEASE` to delete the cache directory as well.
+`bastille destroy [-f|--force] X.Y-RELEASE` to delete the cache directory as well.
diff --git a/usr/local/etc/rc.d/bastille b/usr/local/etc/rc.d/bastille
index 9322c0991..154209867 100755
--- a/usr/local/etc/rc.d/bastille
+++ b/usr/local/etc/rc.d/bastille
@@ -32,6 +32,7 @@ rcvar=${name}_enable
 : ${bastille_conf:="/usr/local/etc/bastille/bastille.conf"}
 : ${bastille_list:="ALL"}
 : ${bastille_rcorder:="NO"}
+: ${bastille_startup_delay:=0}
 
 command=/usr/local/bin/${name}
 start_cmd="bastille_start"
@@ -58,6 +59,7 @@ bastille_start()
     fi
 
     for _jail in ${bastille_ordered_list}; do
+        sleep ${bastille_startup_delay}
         echo "Starting Bastille Container: ${_jail}"
         ${command} start ${_jail}
     done
diff --git a/usr/local/share/bastille/create.sh b/usr/local/share/bastille/create.sh
index af06fd9a2..dc65d412b 100644
--- a/usr/local/share/bastille/create.sh
+++ b/usr/local/share/bastille/create.sh
@@ -571,9 +571,10 @@ create_jail() {
             fi
             # Join together IPv4 and IPv6 parts of ifconfig
             _ifconfig="${_ifconfig_inet} ${_ifconfig_inet6}"
-            bastille template "${NAME}" ${bastille_template_vnet} --arg BASE_TEMPLATE="${bastille_template_base}" --arg HOST_RESOLV_CONF="${bastille_resolv_conf}" --arg EPAIR="${uniq_epair}" --arg GATEWAY="${_gateway}" --arg GATEWAY6="${_gateway6}" --arg IFCONFIG="${_ifconfig}"
+            bastille template "${NAME}" ${bastille_template_vnet} --arg EPAIR="${uniq_epair}" --arg GATEWAY="${_gateway}" --arg GATEWAY6="${_gateway6}" --arg IFCONFIG="${_ifconfig}"
         fi
-    elif [ -n "${THICK_JAIL}" ]; then
+    fi
+    if [ -n "${THICK_JAIL}" ]; then
         if [ -n "${bastille_template_thick}" ]; then
             bastille template "${NAME}" ${bastille_template_thick} --arg BASE_TEMPLATE="${bastille_template_base}" --arg HOST_RESOLV_CONF="${bastille_resolv_conf}"
         fi
diff --git a/usr/local/share/bastille/etcupdate.sh b/usr/local/share/bastille/etcupdate.sh
index 1f0979be2..2f625d413 100644
--- a/usr/local/share/bastille/etcupdate.sh
+++ b/usr/local/share/bastille/etcupdate.sh
@@ -46,7 +46,7 @@ EOF
 bootstrap_etc_release() {
     local _release="${1}"
     local _current="$(sysrc -f /usr/local/etc/bastille/bastille.conf bastille_bootstrap_archives | awk -F': ' '{print $2}')"
-    if ! ls -A "${bastille_releasesdir}/${_release}/usr/src" 2>/dev/null; then
+    if [ -z "$(ls -A "${bastille_releasesdir}/${_release}/usr/src")" ]; then
         sysrc -f /usr/local/etc/bastille/bastille.conf bastille_bootstrap_archives=src
         if ! bastille bootstrap "${_release}" > /dev/null; then
             sysrc -f /usr/local/etc/bastille/bastille.conf bastille_bootstrap_archives="${_current}"
diff --git a/usr/local/share/bastille/list.sh b/usr/local/share/bastille/list.sh
index 23f13d071..5679a8d28 100644
--- a/usr/local/share/bastille/list.sh
+++ b/usr/local/share/bastille/list.sh
@@ -34,7 +34,7 @@
 . /usr/local/etc/bastille/bastille.conf
 
 usage() {
-    error_exit "Usage: bastille list [-j|-a] [release [-p]|template|(jail|container)|log|limit|(import|export|backup)]"
+    error_exit "Usage: bastille list [-j|-a] [release [-p]|template|(jail|container)|log|limit|ports|(import|export|backup)]"
 }
 
 if [ "${1}" = help ] || [ "${1}" = "-h" ] || [ "${1}" = "--help" ]; then
@@ -208,7 +208,7 @@ list_template(){
 
 list_jail(){
     if [ -d "${bastille_jailsdir}" ]; then
-        JAIL_LIST=$(ls "${bastille_jailsdir}" | sed "s/\n//g")
+        JAIL_LIST=$(ls --color=never "${bastille_jailsdir}" | sed "s/\n//g")
         for _JAIL in ${JAIL_LIST}; do
             if [ -f "${bastille_jailsdir}/${_JAIL}/jail.conf" ]; then
                 echo "${_JAIL}"
@@ -230,12 +230,28 @@ list_import(){
     ls "${bastille_backupsdir}" | grep -v ".sha256$"
 }
 
+list_ports(){
+    if [ -d "${bastille_jailsdir}" ]; then
+        JAIL_LIST="$(bastille list jails)"
+        for _jail in ${JAIL_LIST}; do
+            if [ -f "${bastille_jailsdir}/${_jail}/rdr.conf" ]; then
+                _PORTS="$(cat ${bastille_jailsdir}/${_jail}/rdr.conf)"
+                info "[${_jail}]:"
+		echo "${_PORTS}"
+	    fi
+        done
+    fi
+}
+
 if [ $# -gt 0 ]; then
     # Handle special-case commands first.
     case "${1}" in
     all|-a|--all)
         list_all
         ;;
+    port|ports)
+        list_ports
+	;;
     release|releases)
         list_release "${2}"
         ;;
diff --git a/usr/local/share/bastille/rdr.sh b/usr/local/share/bastille/rdr.sh
index f5f426d58..b301e6312 100644
--- a/usr/local/share/bastille/rdr.sh
+++ b/usr/local/share/bastille/rdr.sh
@@ -34,172 +34,341 @@
 . /usr/local/etc/bastille/bastille.conf
 
 usage() {
-    error_exit "Usage: bastille rdr TARGET [clear|list|(tcp|udp host_port jail_port [log ['(' logopts ')'] ] )]"
-}
-
-# Handle special-case commands first.
-case "$1" in
-help|-h|--help)
-    usage
-    ;;
-esac
+    error_notify "Usage: bastille rdr [option(s)] TARGET [clear|reset|list|(tcp|udp)] HOST_PORT JAIL_PORT [log ['(' logopts ')'] ]"
+    cat << EOF
+    Options:
 
-if [ $# -lt 2 ]; then
-    usage
-fi
+    -d | --destination [destination ip]          Limit rdr to a destination IP. Useful if you have multiple IPs on one interface.
+    -i | --interface   [interface]               Set the interface to create the rdr rule on. Useful if you have multiple interfaces.
+    -s | --source      [source ip]               Limit rdr to a source IP. Useful to only allow access from a certian IP or subnet.
+    -t | --type        [ipv4|ipv6]               Specify IP type. Must be used if -s or -d are used. Defaults to both.
+    -x | --debug                                 Enable debug mode.
 
-bastille_root_check
-
-TARGET="${1}"
-JAIL_NAME=""
-JAIL_IP=""
-JAIL_IP6=""
-EXT_IF=""
-shift
+EOF
+    exit 1
+}
 
 check_jail_validity() {
-    # Can only redirect to single jail
-    if [ "${TARGET}" = 'ALL' ]; then
-        error_exit "Can only redirect to a single jail."
-    fi
-
-    # Check if jail name is valid
-    JAIL_NAME=$(/usr/sbin/jls -j "${TARGET}" name 2>/dev/null)
-    if [ -z "${JAIL_NAME}" ]; then
-        error_exit "Jail not found: ${TARGET}"
-    fi
-
-    # Check if jail ip4 address (ip4.addr) is valid (non-VNET only)
-    if [ "$(bastille config $TARGET get vnet)" != 'enabled' ]; then
-        JAIL_IP=$(/usr/sbin/jls -j "${TARGET}" ip4.addr 2>/dev/null)
-        if [ -z "${JAIL_IP}" ] || [ "${JAIL_IP}" = "-" ]; then
-            error_exit "Jail IP not found: ${TARGET}"
+    # Validate jail network type and set IP4/6
+    if [ "$( bastille config ${TARGET} get vnet )" != 'enabled' ]; then
+        _ip4_interfaces="$(bastille config ${TARGET} get ip4.addr | sed 's/,/ /g')"
+        _ip6_interfaces="$(bastille config ${TARGET} get ip6.addr | sed 's/,/ /g')"
+        # Check if jail ip4.addr is valid (non-VNET only)
+        if [ "${_ip4_interfaces}" != "not set" ] && [ "${_ip4_interfaces}" != "disable" ]; then
+            if echo "&{_ip4_interfaces}" | grep -q "|"; then
+                JAIL_IP="$(echo ${_ip4_interfaces} | awk '{print $1}' | awk -F"|" '{print $2}' | sed -E 's#/[0-9]+$##g')"
+            else
+                JAIL_IP="$(echo ${_ip4_interfaces} | sed -E 's#/[0-9]+$##g')"
+            fi
         fi
-    fi
-    # Check if jail ip6 address (ip6.addr) is valid (non-VNET only)
-    if [ "$(bastille config $TARGET get vnet)" != 'enabled' ]; then
-        if [ "$(bastille config $TARGET get ip6)" != 'disable' ] && [ "$(bastille config $TARGET get ip6)" != 'not set' ]; then
-            JAIL_IP6=$(/usr/sbin/jls -j "${TARGET}" ip6.addr 2>/dev/null)
+        # Check if jail ip6.addr is valid (non-VNET only)
+        if [ "${_ip6_interfaces}" != "not set" ] && [ "${_ip6_interfaces}" != "disable" ]; then
+            if echo "&{_ip6_interfaces}" | grep -q "|"; then
+                JAIL_IP6="$(echo ${_ip6_interfaces} | awk '{print $1}' | awk -F"|" '{print $2}' | sed -E 's#/[0-9]+$##g')"
+            else
+                JAIL_IP6="$(echo ${_ip6_interfaces} | sed -E 's#/[0-9]+$##g')"
+            fi
         fi
+    else
+        error_exit "VNET jails do not support rdr."
     fi
-
-
+    
     # Check if rdr-anchor is defined in pf.conf
     if ! (pfctl -sn | grep rdr-anchor | grep 'rdr/\*' >/dev/null); then
         error_exit "rdr-anchor not found in pf.conf"
     fi
+}
 
-    # Check if ext_if is defined in pf.conf
-    if [ -n "${bastille_pf_conf}" ]; then
-        EXT_IF=$(grep "^[[:space:]]*${bastille_network_pf_ext_if}[[:space:]]*=" ${bastille_pf_conf})
-        if [ -z "${EXT_IF}" ]; then
-            error_exit "bastille_network_pf_ext_if (${bastille_network_pf_ext_if}) not defined in pf.conf"
+check_rdr_ip_validity() {
+    local ip="${1}"
+    local ip6="$( echo "${ip}" | grep -E '^(([a-fA-F0-9:]+$)|([a-fA-F0-9:]+\/[0-9]{1,3}$)|SLAAC)' )"
+    if [ -n "${ip6}" ]; then
+        info "Valid: (${ip6})."
+    else
+        local IFS
+        if echo "${ip}" | grep -Eq '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))?$'; then
+            TEST_IP=$(echo "${ip}" | cut -d / -f1)
+            IFS=.
+            set ${TEST_IP}
+            for quad in 1 2 3 4; do
+                if eval [ \$$quad -gt 255 ]; then
+                    error_exit "Invalid: (${TEST_IP})"
+                fi
+            done
+            info "Valid: (${ip})."
+        else
+            error_exit "Invalid: (${ip})."
         fi
     fi
 }
 
-# function: write rule to rdr.conf
+validate_rdr_rule() {
+    local if="${1}"
+    local src="${2}"
+    local dst="${3}"
+    local proto="${4}"
+    local host_port="${5}"
+    local jail_port="${6}"
+    if grep -qs "$if $src $dst $proto $host_port $jail_port" "${bastille_jailsdir}/${TARGET}/rdr.conf"; then
+        error_notify "Error: Ports already in use on this interface."
+        error_exit "See 'bastille list ports' or 'bastille rdr TARGET reset'."
+    fi
+}
+
 persist_rdr_rule() {
-if ! grep -qs "$1 $2 $3" "${bastille_jailsdir}/${JAIL_NAME}/rdr.conf"; then
-    echo "$1 $2 $3" >> "${bastille_jailsdir}/${JAIL_NAME}/rdr.conf"
-fi
+    local inet="${1}"
+    local if="${2}"
+    local src="${3}"
+    local dst="${4}"
+    local proto="${5}"
+    local host_port="${6}"
+    local jail_port="${7}"
+    if ! grep -qs "$inet $if $src $dst $proto $host_port $jail_port" "${bastille_jailsdir}/${TARGET}/rdr.conf"; then
+        echo "$inet $if $src $dst $proto $host_port $jail_port" >> "${bastille_jailsdir}/${TARGET}/rdr.conf"
+    fi
 }
 
 persist_rdr_log_rule() {
-proto=$1;host_port=$2;jail_port=$3;
-shift 3;
-log=$@;
-if ! grep -qs "$proto $host_port $jail_port $log" "${bastille_jailsdir}/${JAIL_NAME}/rdr.conf"; then
-    echo "$proto $host_port $jail_port $log" >> "${bastille_jailsdir}/${JAIL_NAME}/rdr.conf"
-fi
+    local inet="${1}"
+    local if="${2}"
+    local src="${3}"
+    local dst="${4}"
+    local proto="${5}"
+    local host_port="${6}"
+    local jail_port="${7}"
+    shift 7;
+    log=$@;
+    if ! grep -qs "$inet $if $src $dst $proto $host_port $jail_port $log" "${bastille_jailsdir}/${TARGET}/rdr.conf"; then
+        echo "$inet $if $src $dst $proto $host_port $jail_port $log" >> "${bastille_jailsdir}/${TARGET}/rdr.conf"
+    fi
 }
 
-
-# function: load rdr rule via pfctl
 load_rdr_rule() {
-( pfctl -a "rdr/${JAIL_NAME}" -Psn 2>/dev/null;
-  printf '%s\nrdr pass on $%s inet proto %s to port %s -> %s port %s\n' "$EXT_IF" "${bastille_network_pf_ext_if}" "$1" "$2" "$JAIL_IP" "$3" ) \
-      | pfctl -a "rdr/${JAIL_NAME}" -f-
-if [ -n "$JAIL_IP6" ]; then
-  ( pfctl -a "rdr/${JAIL_NAME}" -Psn 2>/dev/null;
-  printf '%s\nrdr pass on $%s inet proto %s to port %s -> %s port %s\n' "$EXT_IF" "${bastille_network_pf_ext_if}" "$1" "$2" "$JAIL_IP6" "$3" ) \
-    | pfctl -a "rdr/${JAIL_NAME}" -f-
-fi
+    local inet="${1}"
+    local if_name="${2}"
+    local if=ext_if=\"${2}\"
+    local src="${3}"
+    local dst="${4}"
+    local proto="${5}"
+    local host_port="${6}"
+    local jail_port="${7}"
+    # Create IPv4 rdr rule
+    # shellcheck disable=SC2193
+    if { [ "${inet}" = "ipv4" ] || [ "${inet}" = "dual" ]; } then
+        if ! ( pfctl -a "rdr/${TARGET}" -Psn 2>/dev/null;
+            printf '%s\nrdr pass on $%s inet proto %s from %s to %s port %s -> %s port %s\n' "$if" "${bastille_network_pf_ext_if}" "$proto" "$src" "$dst" "$host_port" "$JAIL_IP" "$jail_port" ) \
+            | pfctl -a "rdr/${TARGET}" -f-; then
+            error_exit "Failed to create IPv4 rdr rule \"${if_name} ${src} ${dst} ${proto} ${host_port} ${jail_port}\""
+        else
+            info "[${TARGET}]:"
+            echo "IPv4 ${proto}/${host_port}:${jail_port} on ${if_name}" 
+        fi
+    fi
+    # Create IPv6 rdr rule (if ip6.addr is enabled)
+    # shellcheck disable=SC2193
+    if [ -n "${JAIL_IP6}" ] && { [ "${inet}" = "ipv6" ] || [ "${inet}" = "dual" ]; } then
+        if ! ( pfctl -a "rdr/${TARGET}" -Psn;
+            printf '%s\nrdr pass on $%s inet6 proto %s from %s to %s port %s -> %s port %s\n' "$if" "${bastille_network_pf_ext_if}" "$proto" "$src" "$dst" "$host_port" "$JAIL_IP6" "$jail_port" ) \
+            | pfctl -a "rdr/${TARGET}" -f-; then
+            error_exit "Failed to create IPv6 rdr rule \"${if_name} ${src} ${dst} ${proto} ${host_port} ${jail_port}\""
+        else
+            info "[${TARGET}]:"
+            echo "IPv6 ${proto}/${host_port}:${jail_port} on ${if_name}"
+        fi
+    fi
 }
 
-# function: load rdr rule with log via pfctl
 load_rdr_log_rule() {
-proto=$1;host_port=$2;jail_port=$3;
-shift 3;
-log=$@
-( pfctl -a "rdr/${JAIL_NAME}" -Psn 2>/dev/null;
-  printf '%s\nrdr pass %s on $%s inet proto %s to port %s -> %s port %s\n' "$EXT_IF" "$log" "${bastille_network_pf_ext_if}" "$proto" "$host_port" "$JAIL_IP" "$jail_port" ) \
-      | pfctl -a "rdr/${JAIL_NAME}" -f-
-if [ -n "$JAIL_IP6" ]; then
-  ( pfctl -a "rdr/${JAIL_NAME}" -Psn 2>/dev/null;
-  printf '%s\nrdr pass %s on $%s inet proto %s to port %s -> %s port %s\n' "$EXT_IF" "$log" "${bastille_network_pf_ext_if}" "$proto" "$host_port" "$JAIL_IP6" "$jail_port" ) \
-    | pfctl -a "rdr/${JAIL_NAME}" -f-
+    local inet="${1}"
+    local if_name="${2}"
+    local if=ext_if=\"${2}\"
+    local src="${3}"
+    local dst="${4}"
+    local proto="${5}"
+    local host_port="${6}"
+    local jail_port="${7}"
+    shift 7;
+    log=$@
+    # Create IPv4 rule with log
+    # shellcheck disable=SC2193
+    if { [ "${inet}" = "ipv4" ] || [ "${inet}" = "dual" ]; } then
+        if ! ( pfctl -a "rdr/${TARGET}" -Psn;
+            printf '%s\nrdr pass %s on $%s inet proto %s from %s to %s port %s -> %s port %s\n' "$if" "$log" "${bastille_network_pf_ext_if}" "$proto" "$src" "$dst" "$host_port" "$JAIL_IP" "$jail_port" ) \
+            | pfctl -a "rdr/${TARGET}" -f-; then
+            error_exit "Failed to create logged IPv4 rdr rule \"${if_name} ${src} ${dst} ${proto} ${host_port} ${jail_port}\""
+        else
+            info "[${TARGET}]:"
+            echo "IPv4 ${proto}/${host_port}:${jail_port} on ${if_name}"
+        fi
+    fi
+    # Create IPv6 rdr rule with log (if ip6.addr is enabled)
+    # shellcheck disable=SC2193
+    if [ -n "${JAIL_IP6}" ] && { [ "${inet}" = "ipv6" ] || [ "${inet}" = "dual" ]; } then 
+        if ! ( pfctl -a "rdr/${TARGET}" -Psn;
+            printf '%s\nrdr pass %s on $%s inet6 proto %s from %s to %s port %s -> %s port %s\n' "$if" "$log" "${bastille_network_pf_ext_if}" "$proto" "$src" "$dst" "$host_port" "$JAIL_IP6" "$jail_port" ) \
+            | pfctl -a "rdr/${TARGET}" -f-; then
+            error_exit "Failed to create logged IPv6 rdr rule \"${if_name} ${src} ${dst} ${proto} ${host_port} ${jail_port}\""
+        else
+            info "[${TARGET}]:"
+            echo "IPv6 ${proto}/${host_port}:${jail_port} on ${if_name}"
+        fi
+    fi
+}
+
+# Handle options.
+RDR_IF="$(grep "^[[:space:]]*${bastille_network_pf_ext_if}[[:space:]]*=" ${bastille_pf_conf} | awk -F'"' '{print $2}')"
+RDR_SRC="any"
+RDR_DST="any"
+RDR_INET="dual"
+OPTION_IF=0
+OPTION_SRC=0
+OPTION_DST=0
+OPTION_INET_TYPE=0
+while [ "$#" -gt 0 ]; do
+    case "${1}" in
+        -h|--help|help)
+            usage
+            ;;
+        -d|--destination)
+            if ifconfig | grep -owq "inet ${2}"; then
+	        OPTION_DST=1
+                RDR_DST="${2}"
+                shift 2
+            else
+                error_exit "${2} is not an IP on this system."
+            fi
+            ;;
+        -i|--interface)
+            if ifconfig | grep -owq "${2}:"; then
+                OPTION_IF=1
+                RDR_IF="${2}"
+                shift 2
+            else
+                error_exit "${2} is not a valid interface."
+            fi
+            ;;
+        -s|--source)
+            check_rdr_ip_validity "${2}"
+            OPTION_SRC=1
+            RDR_SRC="${2}"
+            shift 2
+            ;;
+        -t|--type)
+            if [ "${2}" != "ipv4" ] && [ "${2}" != "ipv6" ]; then
+                error_exit "[-t|--type] must be [ipv4|ipv6]"
+            else
+                OPTION_INET_TYPE=1
+                RDR_INET="${2}"
+                shift 2
+            fi
+            ;;
+        -x|--debug)
+            enable_debug
+            shift
+            ;;
+        -*)
+            error_exit "Unknown option: \"${1}\""
+            ;;
+        *)
+            break
+            ;;
+    esac
+done
+
+if [ "$#" -lt 2 ]; then
+    usage
 fi
 
-}
+TARGET="${1}"
+JAIL_IP=""
+JAIL_IP6=""
+shift
+
+bastille_root_check
+set_target_single "${TARGET}"
 
-while [ $# -gt 0 ]; do
-    case "$1" in
+while [ "$#" -gt 0 ]; do
+    case "${1}" in
         list)
-            if [ "${TARGET}" = 'ALL' ]; then
-                for JAIL_NAME in $(ls "${bastille_jailsdir}" | sed "s/\n//g"); do
-                    echo "${JAIL_NAME} redirects:"
-                    pfctl -a "rdr/${JAIL_NAME}" -Psn 2>/dev/null
-                done
+            if [ "${OPTION_IF}" -eq 1 ] || [ "${OPTION_SRC}" -eq 1 ] || [ "${OPTION_DST}" -eq 1 ] || [ "${OPTION_INET_TYPE}" -eq 1 ];then
+                error_exit "Command \"${1}\" cannot be used with options."
+	        elif [ -n "${2}" ]; then
+                usage
             else
                 check_jail_validity
-                pfctl -a "rdr/${JAIL_NAME}" -Psn 2>/dev/null
+                pfctl -a "rdr/${TARGET}" -Psn 2>/dev/null
             fi
             shift
             ;;
         clear)
-            if [ "${TARGET}" = 'ALL' ]; then
-                for JAIL_NAME in $(ls "${bastille_jailsdir}" | sed "s/\n//g"); do
-                    echo "${JAIL_NAME} redirects:"
-                    pfctl -a "rdr/${JAIL_NAME}" -Fn
-                done
+            if [ "${OPTION_IF}" -eq 1 ] || [ "${OPTION_SRC}" -eq 1 ] || [ "${OPTION_DST}" -eq 1 ] || [ "${OPTION_INET_TYPE}" -eq 1 ];then
+                error_exit "Command \"${1}\" cannot be used with options."
+	        elif [ -n "${2}" ]; then
+                usage
             else
                 check_jail_validity
-                pfctl -a "rdr/${JAIL_NAME}" -Fn
+                echo "${TARGET} redirects:"
+                pfctl -a "rdr/${TARGET}" -Fn
             fi
             shift
             ;;
+        reset)
+            if [ "${OPTION_IF}" -eq 1 ] || [ "${OPTION_SRC}" -eq 1 ] || [ "${OPTION_DST}" -eq 1 ] || [ "${OPTION_INET_TYPE}" -eq 1 ];then
+                error_exit "Command \"${1}\" cannot be used with options."
+	        elif [ -n "${2}" ]; then
+                usage
+            else
+                check_jail_validity
+                echo "${TARGET} redirects:"
+                pfctl -a "rdr/${TARGET}" -Fn
+		if rm -f "${bastille_jailsdir}/${_jail}/rdr.conf"; then
+                    info "[${TARGET}]: rdr.conf removed"
+	        fi
+            fi
+            shift
+            ;;	    
         tcp|udp)
-            if [ $# -lt 3 ]; then
+            if [ "$#" -lt 3 ]; then
                 usage
-            elif [ $# -eq 3 ]; then
+            elif [ "${OPTION_SRC}" -eq 1 ] || [ "${OPTION_DST}" -eq 1 ] && [ "${OPTION_INET_TYPE}" -ne 1 ];then
+                error_exit "[-t|--type] must be set when using [-s|--source] or [-d|--destination]"
+            elif [ "$#" -eq 3 ]; then
                 check_jail_validity
-                persist_rdr_rule $1 $2 $3
-                load_rdr_rule $1 $2 $3
-                shift 3
+                validate_rdr_rule $RDR_IF $RDR_SRC $RDR_DST $1 $2 $3
+                persist_rdr_rule $RDR_INET $RDR_IF $RDR_SRC $RDR_DST $1 $2 $3
+                load_rdr_rule $RDR_INET $RDR_IF $RDR_SRC $RDR_DST $1 $2 $3
+		# Temp block to remove old format after new format is loaded the first time
+		while read rules; do
+                if [ "$(echo ${rules} | wc -w)" -lt 6 ]; then
+                    sed -i '' "/^${rules}$/d" "${bastille_jailsdir}/${TARGET}/rdr.conf"
+                fi
+                done < "${bastille_jailsdir}/${TARGET}/rdr.conf"
+                shift "$#"
             else
-                case "$4" in
+                case "${4}" in
                     log)
                         proto=$1
                         host_port=$2
                         jail_port=$3
                         shift 3
-                        if [ $# -gt 3 ]; then
+                        if [ "$#" -gt 3 ]; then
                             for last in "$@"; do
                                 true
                             done
-                            if [ "$2" = "(" ] && [ "$last" = ")" ] ; then
+                            if [ "${2}" = "(" ] && [ "${last}" = ")" ] ; then
                                 check_jail_validity
-                                persist_rdr_log_rule "$proto" "$host_port" "$jail_port" "$@"
-                                load_rdr_log_rule "$proto" "$host_port" "$jail_port" "$@"
+                                validate_rdr_rule $RDR_IF $RDR_SRC $RDR_DST $1 $2 $3
+                                persist_rdr_log_rule $RDR_INET $RDR_IF $RDR_SRC $RDR_DST $proto $host_port $jail_port "$@"
+                                load_rdr_log_rule $RDR_INET $RDR_IF $RDR_SRC $RDR_DST $proto $host_port $jail_port "$@"                                
                                 shift $#
                             else
                                 usage
                             fi
                         elif [ $# -eq 1 ]; then
                             check_jail_validity
-                            persist_rdr_log_rule $proto $host_port $jail_port "$@"
-                            load_rdr_log_rule $proto $host_port $jail_port "$@"
+                            validate_rdr_rule $RDR_IF $RDR_SRC $RDR_DST $1 $2 $3
+                            persist_rdr_log_rule $RDR_INET $RDR_IF $RDR_SRC $RDR_DST $proto $host_port $jail_port "$@"
+                            load_rdr_log_rule $RDR_INET $RDR_IF $RDR_SRC $RDR_DST $proto $host_port $jail_port "$@"
                             shift 1
                         else
                             usage
@@ -212,7 +381,26 @@ while [ $# -gt 0 ]; do
             fi
             ;;
         *)
-            usage
+            if [ "${1}" = "dual" ] || [ "${1}" = "ipv4" ] || [ "${1}" = "ipv6" ]; then
+                RDR_INET="${1}"
+            else 
+                usage
+            fi
+            if [ "$#" -eq 7 ] && { [ "${5}" = "tcp" ] || [ "${5}" = "udp" ]; } then
+                check_jail_validity
+                validate_rdr_rule $RDR_IF $RDR_SRC $RDR_DST $1 $2 $3
+                persist_rdr_rule "$@"
+                load_rdr_rule "$@"
+                shift "$#"
+            elif [ "$#" -ge 8 ] && [ "${8}" = "log" ]; then
+                check_jail_validity
+                validate_rdr_rule $RDR_IF $RDR_SRC $RDR_DST $1 $2 $3
+                persist_rdr_log_rule "$@"
+                load_rdr_log_rule "$@"
+                shift "$#"
+            else
+                usage
+            fi
             ;;
     esac
 done
diff --git a/usr/local/share/bastille/templates/default/base/Bastillefile b/usr/local/share/bastille/templates/default/base/Bastillefile
index 7418fba64..ad8984469 100644
--- a/usr/local/share/bastille/templates/default/base/Bastillefile
+++ b/usr/local/share/bastille/templates/default/base/Bastillefile
@@ -1,6 +1,9 @@
 ARG HOST_RESOLV_CONF=/etc/resolv.conf
 
 CMD touch /etc/rc.conf
+CMD touch /etc/periodic.conf
+CMD sysrc -f /etc/periodic.conf daily_status_world_kernel="NO"
+
 SYSRC syslogd_flags="-ss"
 SYSRC sendmail_enable="NO"
 SYSRC sendmail_submit_enable="NO"
diff --git a/usr/local/share/bastille/templates/default/vnet/Bastillefile b/usr/local/share/bastille/templates/default/vnet/Bastillefile
index 902fe6dd5..956134859 100644
--- a/usr/local/share/bastille/templates/default/vnet/Bastillefile
+++ b/usr/local/share/bastille/templates/default/vnet/Bastillefile
@@ -1,8 +1,3 @@
-ARG BASE_TEMPLATE=default/base
-ARG HOST_RESOLV_CONF=/etc/resolv.conf
-
-INCLUDE ${BASE_TEMPLATE} --arg HOST_RESOLV_CONF="${HOST_RESOLV_CONF}"
-
 ARG EPAIR
 ARG GATEWAY
 ARG GATEWAY6