the biggest issue with N.switch is that it requires static outgoing ports.
i have not used pf in years (opnsense here so should be same) but what you need to do is set hybrid outgoing NAT, designate a static IP to the switch, and then tell outgoing NAT for that IP to use static ports, outgoing.
by default pf\opn randomises the outgoing NAT port and that messes up the Nswitch royally. (especially online like MK8deluxe)
most of what is being posted about uPNP and N.switch is not correct. As long as your firewall rules allow the switch to get out (lock ports if you want to, but its a console, so … why?)
Nintendo servers simply do not like you joining a game lobby on outgoing 34567, and then starting the game on 23456, and then turning a corner on lap 2 switching to outgoing port 18845.
I run iRedMail (a collection of dovecot, postfix etc, plus sogo and roundcube web clients and managed by a nice web frontend, all open source and runs on any linux.
I’ve run for about 8 years, no dramas other than my isp technocally doesnt allow it. But they don’t block anything and occasionally they submit their ip ranges for customers to places like spamhaus, so i just script check every month to see if they added my ip back, then i just submit removal, it takes all of 30sec. (IP is semi static, probably changes once every 9 months or so, so not a drama to update dkim on my domain registrar.)