As it seems you known what you're doing, I'll keep it short:

For the error directive to be helpful, you should commit between the keyword and the data, so the parser cannot backtrack out of it. This will force the location of the error to a position that can produce helpful error messages.

For comments it would help to handle whitespace in your grammer and disable automated whitespace handling. So you could define a nl as "ws* comment? nlchar" and comment as "'#' anychar_but_nlchar*". If you need inline comments, something like ws="(space|tab|comment2) ws?", comment2="'/*' anychar_but_nlchar* '*/'" would be the way to go.

"subnet_directive(s?)" allows all directives unlimited times. That is easy, and I would choose that approach, too, and check after the parsing for the number of directives. If you want to do it in the grammar, you need to recompose "subnet_directive", e.g. subnet_directive="repeatable_directive(s?) server? repeatable_directive(s?) keyfile? repeatable_directive(s?) default? repeatable_directive(s?) | repeatable_directive(s?) keyfile? repeatable_directive(s?) server? repeatable_directive(s?) default? repeatable_directive(s?) | repeatable_directive(s?) default? repeatable_directive(s?) keyfile? repeatable_directive(s?) server? repeatable_directive(s?) | repeatable_directive(s?) default? repeatable_directive(s?) server? repeatable_directive(s?) keyfile? repeatable_directive(s?)". Or, and that's a little bit easier, you modify the attached Perl code to reject being run twice---analyze the existing data structure if the value is already there...