The FAQ6 section for VMM Networking incorrectly specified the range for Shared Address Space. RFC6598 section 7 calls out 100.64.0.0/10
As far as I can tell, it’s just the FAQ that misstates this. The vm manpages seem to all call out the correct range --- faq6.html Wed Apr 4 06:19:18 2018 +++ faq6.html.patched Wed Apr 4 06:20:15 2018 @@ -668,7 +668,7 @@ (<a href="https://tools.ietf.org/html/rfc6598">RFC6598</a>) are similar to private addresses in that they are not globally routable, but are intended to be used on equipment that can perform address translation. - The address space is <tt>10.64.0.0/10</tt>. + The address space is <tt>100.64.0.0/10</tt>. </ul> <h3>Option 1 - VMs only need to talk to the host and each other</h3> @@ -695,7 +695,7 @@ <a href="pf/nat.html">Network Address Translation</a>: <blockquote><pre> -match out on egress from 10.64.0.0/10 to any nat-to (egress) +match out on egress from 100.64.0.0/10 to any nat-to (egress) </pre></blockquote> Reload the pf ruleset and the VM(s) can now connect to the internet.