FreeBSD 13 PF blocking jail traffic

After upgrading my FreeBSD system from 12.2 to 13.0-p3 PF is blocking all traffic to my jails. When disabling PF everything works fine (except from being unprotected ;))

I tried to figure out what rule is blocking this traffic by setting 'block in log all', but apart from some obvious multicast stuff nothing comes up that could explain why this traffic is blocked.

Again, before everything worked perfectly fine under version 12.2. I did find some articles about v13 now filtering over VLAN instead of lo0 but I don't use any VLANs.

In what direction should I seek further?

Update 2021-07-15:

For clarity sake: heres my pf_rules file:

set block-policy return
set optimization aggressive
set skip on { lo0, lo1, lo2, lo3, lo4, lo5 }
ext_if=hn0
ext_address="{ 192.x.x.x, 2001:981:x.x::x }"
ext_services = "{ ssh, http, https, smtp, smtps }"
tcp_services = "{ ftp, ssh, domain, ntp, www, smtp, smtps, submission, http, https,nfs}"
udp_services = "{ domain, ntp, nfs }"
icmp6_types="{ 2, 128 }" # packet too big, echo request (ping6)
icmp6_types_ext_if="{ 128, 133, 134, 135, 136, 137 }"
jail_net = "192.168.1.0/24"
jail_services = "{ mysql, http, smtp, 587, 3000 }"
table <sshguard> persist
scrub in all
nat pass on $ext_if from $jail_net to any -> $ext_address
block in log on $ext_if proto tcp from <sshguard> to any port ssh label "ssh bruteforce"
block in log all
pass in quick from <pf_whitelist> flags S/SA synproxy state
pass out on $ext_if inet6 proto icmp6 all icmp6-type echoreq keep state
pass out on $ext_if inet proto udp to port 33433:33626
pass out on $ext_if inet6 proto udp to port 33433:33626
pass in on $ext_if inet6 proto ipv6-icmp icmp6-type $icmp6_types keep state
pass in on $ext_if inet6 proto ipv6-icmp from any to { ($ext_if ), ff02::1/16 } icmp6-type $i
cmp6_types_ext_if keep state
pass in on $ext_if proto tcp from any to $ext_address port $ext_services keep state
pass in on $ext_if inet6 proto tcp from any to $ext_address port $ext_services keep state
pass out on $ext_if inet proto tcp to any port $tcp_services keep state
pass out on $ext_if inet6 proto tcp to any port $tcp_services keep state
pass out on $ext_if inet6 proto udp to any port $udp_services
pass proto udp to any port $udp_services keep state
pass in proto tcp from any to $jail_net port $jail_services keep state
pass out proto tcp from $jail_net to any port $jail_services keep state
pass inet proto icmp from any to any

This has worked for many years until FreeBSD 13

Quoting from TCP SYN Proxy:

| The SYN proxy will not work if PF is running on a bridge(4).

Remove the flag synproxy

pass in quick from <pf_whitelist> flags S/SA synproxy state

Try instead

pass in quick from <pf_whitelist> flags S/SA keep state

If this works you can use it for jails only and keep synproxy for others, e.g.

pass in quick from <pf_whitelist> to $jail_net flags S/SA keep state
pass in quick from <pf_whitelist> flags S/SA synproxy state