issue routing from zerotier to container with PF

I’m trying to set up rules so I can access a few different containers from zerotier. I’ve already set up an ssh-x11 container and the passthrough is working fine with:

rdr on $ext_zero proto tcp from any to $ext_zero port 8000 -> 10.1.1.3 port 22

where $ext_zero is the variable for the zerotier bridge.

However, trying to stream music with jellyfin with:

rdr on $ext_zero proto tcp from any to $ext_zero port 8096 -> 10.1.1.6 port 8096

I get consistent connection refused messages.

The full pf.conf for redirections: Code:

<pre style="background-color:#ffffff;">
<span style="color:#323232;">table <jails> persist
</span><span style="color:#323232;">nat on $ext_if from <jails> to any -> ($ext_if:0)
</span><span style="color:#323232;">rdr-anchor "rdr/*"
</span><span style="color:#323232;">rdr on $ext_zero proto tcp from any to $ext_zero port 8000 -> 10.1.1.3 port 22
</span><span style="color:#323232;">rdr on $ext_zero proto tcp from any to $ext_zero port 8096 -> 10.1.1.6 port 8096
</span><span style="color:#323232;">rdr on $ext_zero proto tcp from any to $ext_zero port 8920 -> 10.1.1.6 port 8920
</span><span style="color:#323232;">rdr on $ext_zero proto udp from any to $ext_zero port 1900 -> 10.1.1.6 port 1900
</span><span style="color:#323232;">rdr on $ext_zero proto udp from any to $ext_zero port 7359 -> 10.1.1.6 port 7359
</span>

The system is FreeBSD, the jails are roughly equivalent to a docker compose install.

Jellyfin is set to accept remote connections, with the whitelist left blank as per their instructions to allow all addresses. Why will ssh connect but not jellyfin?>>