> Virtual network for a bunch of jails with nat. I wanted exposed ports on the host machine mapped to a reverse proxy jail that did tls termination before forwarding to other jails on a virtual network (while allowing the jails on the virtual net outgoing internet access).

Jails are old, and there's a wealth of outdated documentation around which makes it confusing when trying to understand how things works.

In case someone else is reading this, it's not different from what Docker does automatically for you.

I typically use vnet (which gives the jail an entire virtualized network stack, something like macvlan?) and either use NAT or bridges for connectivity. NAT for machines with only one public IP (like VPSes) and bridges for homelab setup where I want a more visible setup.

When setting up NAT I just use PF as my firewall, and assign static addresses to each jail.