Hey, #FreeBSD jail/networking folks:
I've been trying to figure out whether VNET jail-networking *requires* a bridge0 device with both the LAN-facing adapter and all the common epair ends, or whether, since the epairs are all virtual interfaces, pf(4) can manage to do the routing/NAT without everything sitting on the same bridge0 device.
However, when I try this (including net.{inet.ip,inet6,ip6}.forwarding=1) traffic doesn't seem to flow. Is there some obvious thing I've missed or that I should be testing? Or do I just need to throw everything on a bridge0 and deal with it?