pf

blacklistctl dump -b

sysrc pf_enable=yes
sysrc pflog_enable=yes
service pf start
service pflog start

tcpdump -n -e -ttt -r /var/log/pflog

title="/etc/pf.conf"
ext_if="vtnet0"

block in all
pass out all keep state

pass in on $ext_if proto tcp to ($ext_if) port ssh

ext_if="vtnet0"
wg_if="wg0"

set block-policy return
scrub in on $ext_if all fragment reassemble
set skip on lo

table <jails> persist
nat on $ext_if from <jails> to any -> ($ext_if:0)
rdr-anchor "rdr/*"

block in all
pass out quick keep state
antispoof for $ext_if inet
pass in inet proto tcp from any to any port ssh flags S/SA keep state
pass in inet proto tcp from any to any port 443 flags S/SA keep state
pass in quick inet proto icmp all
pass in on $wg_if from any to any