pfconf

# /etc/pf.conf for Grafana jail

intif = "ng0_<jailname>"
serversource = "<jail_ip>"
serverip = $serversource

servertcpports = "{ 3000, 8086 }"
trustedhosts = "{ <ip/subnet/hostname/whatever>, ... }" # NB: Make sure gateway is trusted host

privnets = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 255.255.255.255/32, 169.254.0.0/16 }"
freebsd_pkg = "{ pkg, SRV _http._tcp.pkg, vuxml }"
   # NB: You're going to have to resolve these yourself (adding f.o to each and querying
   # NB: For the SRV record, get the IP of each name returned
   # NB: The format you want is similar $privnets but I won't list the IP address as they change
   # NB: E.g., { IP1, IP2, IP3, IP4, IP5, ... }
multicast = "{ 224.0.0.0/4, ff00::/8 }"

set loginterface $intif
set limit { states 20000 }
table <badhosts> persist
scrub all reassemble tcp no-df random-id max-mss 1280

rdr on $intif proto tcp from $trustedhosts to $serversource port $servertcpports -> $serverip
rdr on $intif proto tcp from $serversource to $freebsd_pkg port 80 -> $freebsd_pkg
rdr on $intif proto tcp from $freebsd_pkg port 80 to $serversource -> $serverip

block log
pass quick on lo0 all

block in quick on $intif proto udp from any port { 80, 8080 } to any port 123

block drop in log quick inet6
block drop in log on $intif from $privnets to any
block drop in log on $intif from any to $privnets
block drop in log quick on $intif from { <badhosts> }
block drop in log quick proto icmp all

pass in  on $intif proto tcp from $trustedhosts to $serverip port $servertcpports keep state
pass out on $intif proto tcp from $serverip to $freebsd_pkg port 80 keep state

block drop in  quick inet  proto icmp      all
block drop out quick inet  proto icmp      all
block drop in  quick inet6 proto ipv6-icmp all
block drop out quick inet6 proto ipv6-icmp all

pass out on $intif from any to $intif:network keep state

block drop in  quick log proto udp from any to any port 5353
block drop out quick log proto udp from any port 5353 to any
block drop in  quick log from any to $multicast
block drop in  quick log from $multicast to any
block drop out quick log from any to $multicast
block drop out quick log from $multicast to any