Comment by SpaceInvader

Regarding jails - I do use separate loopback device per jail, plus pf with nat. No issues with firewalling.