diff --git a/net/containernetworking-plugins/Makefile b/net/containernetworking-plugins/Makefile
index 87d632f5aa83..ba646e5cfd92 100644
--- a/net/containernetworking-plugins/Makefile
+++ b/net/containernetworking-plugins/Makefile
@@ -1,34 +1,33 @@
 PORTNAME=	containernetworking-plugins
-DISTVERSION=	0.4
-PORTREVISION=	1
+DISTVERSION=	0.5
 CATEGORIES=	net
 
 MAINTAINER=	dfr@FreeBSD.org
 COMMENT=	Networking plugins for container networking support
 WWW=		https://www.cni.dev/
 
 LICENSE=	GPLv2
 
 USES=		go:no_targets
 BUILD_DEPENDS=	bash:shells/bash
 
 USE_GITHUB=	yes
 GH_ACCOUNT=	dfr
 GH_PROJECT=	plugins
-GH_TAGNAME=	freebsd-v0.4
+GH_TAGNAME=	freebsd-v${DISTVERSION}
 GH_TUPLE=	golang:sys:v0.6.0:sys
 
 pre-patch:
 	${RM} -r ${WRKSRC}/vendor/golang.org/x/sys
 	${LN} -s ${WRKDIR}/sys-* ${WRKSRC}/vendor/golang.org/x/sys
 
 do-build:
 	cd ${WRKSRC} && ${SETENV} XDG_CACHE_HOME=${WRKDIR}/.cache GO=${GO_CMD} ./build_freebsd.sh
 
 do-install:
 	${MKDIR} ${STAGEDIR}${PREFIX}/libexec/cni
 	${MKDIR} ${STAGEDIR}${PREFIX}/etc/containers
 	cd ${WRKSRC} && ${INSTALL_PROGRAM} bin/* ${STAGEDIR}${PREFIX}/libexec/cni
 	${INSTALL_DATA} files/pf.conf.sample ${STAGEDIR}${PREFIX}/etc/containers
 
 .include <bsd.port.mk>
diff --git a/net/containernetworking-plugins/distinfo b/net/containernetworking-plugins/distinfo
index 09b16c918d5c..9c34a809eb56 100644
--- a/net/containernetworking-plugins/distinfo
+++ b/net/containernetworking-plugins/distinfo
@@ -1,5 +1,5 @@
-TIMESTAMP = 1692269530
-SHA256 (dfr-plugins-0.4-freebsd-v0.4_GH0.tar.gz) = 475d9e194d0fb84ba1b8a3c5ad363a016f75c6adddef02fb71aefb7e705413f9
-SIZE (dfr-plugins-0.4-freebsd-v0.4_GH0.tar.gz) = 4198780
+TIMESTAMP = 1697295741
+SHA256 (dfr-plugins-0.5-freebsd-v0.5_GH0.tar.gz) = ae97b270a350a291e96a57a964df84cf7a3d82311e3a8b0476f1e0e95b9bbb7f
+SIZE (dfr-plugins-0.5-freebsd-v0.5_GH0.tar.gz) = 4198686
 SHA256 (golang-sys-v0.6.0_GH0.tar.gz) = b4f6d17c7a128f76169964b437cb66b3f2dbf9a33361928ec19dfecf7b03fc54
 SIZE (golang-sys-v0.6.0_GH0.tar.gz) = 1434234
diff --git a/net/containernetworking-plugins/files/pf.conf.sample b/net/containernetworking-plugins/files/pf.conf.sample
index c2d99f2a3bbf..71976cdb0c66 100644
--- a/net/containernetworking-plugins/files/pf.conf.sample
+++ b/net/containernetworking-plugins/files/pf.conf.sample
@@ -1,9 +1,10 @@
 # Change these to the interface(s) with the default route
 v4egress_if = "ix0"
 v6egress_if = "ix0"
 
 nat on $v4egress_if inet from <cni-nat> to any -> ($v4egress_if)
 nat on $v6egress_if inet6 from <cni-nat> to !ff00::/8 -> ($v6egress_if)
 
 rdr-anchor "cni-rdr/*"
+nat-anchor "cni-rdr/*"
 table <cni-nat>
diff --git a/net/containernetworking-plugins/pkg-message b/net/containernetworking-plugins/pkg-message
index 47db23aecfd1..bae89ef8843a 100644
--- a/net/containernetworking-plugins/pkg-message
+++ b/net/containernetworking-plugins/pkg-message
@@ -1,30 +1,39 @@
 Container networking relies on NAT to allow container network packets
 out to the host's network. This requires a PF firewall to perform the
 translation. A simple example is included - to use it:
 
 # cp /usr/local/etc/containers/pf.conf.sample /etc/pf.conf
 ...
 Edit /etc/pf.conf and set v4egress_if, v6egress_if to your network interface(s)s
 ...
 # sysrc pf_enable=YES
 # service pf start
 
 The sample PF configuration includes support for port redirections. These are
 implemented as redirect rules in anchors nested under cni-rdr.
 
 Support for redirecting connections from the container host to services running
 inside a container is included for FreeBSD 13.3 and later. To enable this, first
 load the pf kernel module, by adding pf_load="YES" to /boot/loader.conf and
 enable PF support for these redirections using sysctl:
 
 # kldload pf
 # sysctl net.pf.filter_local=1
 # service pf restart
 
-These redirect rules do not currently work if the destination address is
-localhost (e.g. 127.0.0.1 or ::1) - always use the hosts IP address when
-connecting to a service inside a container using a port redirection. For example
-if host port 1234 is redirected to an http service running in a container, you
-could connect to it using:
+Redirect rules will work if the destination address is localhost (e.g. 127.0.0.1
+or ::1) - to enable this, the following line must be included in your
+/etc/pf.conf:
+
+nat-anchor "cni-rdr/*"
+
+if upgrading from an older version, this needs to be added to /etc/pf.conf.
+
+For example if host port 1234 is redirected to an http service running in a
+container, you could connect to it using:
 
 # fetch -o- http://$(hostname):1234
+
+or
+
+# fetch -o- http://localhost:1234