Can you elaborate on what this looks like?

jail.conf:

ssh { exec.start = "/bin/sh /etc/rc"; exec.stop = "/bin/sh /etc/rc.shutdown"; exec.clean; mount.devfs; path = "/var/jail/ssh"; host.hostname = "ssh"; vnet; vnet.interface += "em0"; }

It's IPv6 only, so this is key in rc.conf: rtsold_enable="YES"

OpenBSD PF based router does the rest. IPv6 simplifies things here.

PF on FreeBSD isn't the most ideal, sure, but I can limit local access on inet6.

For SSH tunnel, it's straight forward.

FWIW VNET is not inherently IPv6 only. I'm using it in an IPv4 context just fine.

An extra NIC is fine if you've got slots, but you can also do an if_bridge in the main host, add the real nic and half of an if_epair; then move the other half to the vnet jail.

Potentially a non-vnet jail with the ipv4/ipv6 options set may also be an option. I used to use jails with those settings to squeeze multiple environments into a single host at Yahoo.

I use only if_epair and then pf to NAT it to the external world. I’ve only had issues with if_bridge, where I would either be able to make connections between jail and the external world, but not between host and jail or vice versa (between host and jail fine, but not between jail and external world). And it would act really flaky, like getting one ping response, followed by silence. pf is a lot simpler and more reliable.

> I used to use jails with those settings to squeeze multiple environments into a single host at Yahoo.

Greetings! Miss the ole days at the ‘Hoo when we were all FBSD based!