[admin@lockdown ~]$ cat /etc/pf.conf
ext_if="vtnet0"
NET_JAIL="{ 192.168.69.0/24 192.168.68.0/24 192.168.0.0/24 }"

scrub in all

# Won't filter traffic on loopback
set skip on lo0

# nat all jail traffic
nat on $ext_if inet from $NET_JAIL to any -> ($ext_if)

# Allow all OUT, block all IN on $ext_if
block in log all
pass out all

# Protects against activity from spoofed or forged IPs
antispoof for $ext_if inet

# Allow traceroute
pass out on $ext_if inet proto udp from any to any port 33433 >< 33626

# Allow ICMP ping
pass inet proto icmp from any to any

# Allow SSH/d
pass in quick on $ext_if proto tcp from any to any port ssh flags S/SA keep state

### Jail traffic policies

# Allowing inbound traffic
pass quick proto tcp from any to $NET_JAIL port { 443, 80 } flags S/SA keep state

# Note: when using VNET with jail's own subnet, jail outgoing traffic
# is actually seen as incoming traffic by the FreeBSD Host.
# As such, a 'out' rule is declared as 'in' rule and 'from $whateverJail'.

# Allowing outbound DNS traffic inside jails
pass in proto { tcp, udp } from $NET_JAIL to any port domain

# Allow traceroute inside jails
pass in proto udp from $NET_JAIL to any port 33433 >< 33626

# Allow pkg, freebsd-update and anything else using http/s
pass in proto { tcp, udp } from $NET_JAIL to any port { 443, 80 }

### Jail traffic policies <EOL
[admin@lockdown ~]$