I just ran into a similar problem with bridging - see inline:

On Thu, 2004-07-15 at 09:06, Kolia wrote:
> Manuel Kasper wrote:
> >Wait, it's not that easy. Have a look at the code in
> >filter_rules_generate() that fills in $optcfg. For bridged
> >interfaces, the IP address/subnet mask of the interface that the
> >interface is bridged to is filled in 'ip'/'sn'. If you get empty
> >values for 'ip'/'sn', that means that the bridge target interface
> >itself isn't configured properly with an IP address/subnet mask. This
> >can only happen if it is also bridged, or simply disabled. The former
> >case is checked by the webGUI, but not the latter.
> >

Or that the WAN is getting it's IP dynamically.  If I bridge opt1 to the
wan while using DHCP on the wan, 'ip' gets filled with 'dhcp', which
causes ipf to bomb out.  I'm guessing the same will happen with
PPPoE/PPPoA.  I see the function to get the current wan IP, but not the
current wan subnet - am I missing a function, or does it need written?

-- 
Justin Ellison <justin at techadvise dot com>