jail_net = "192.168.123.0/24"
jail_net6 = "fd42:1234:5678:1::/64"
vpn_net = "10.8.0.0/24"

set skip on lo

# NAT so jails can access internet
nat on wg0 inet from $jail_net to any -> (wg0)
nat on em0 inet from $jail_net to any -> (em0)

# IPv6 NAT
nat on wg0 inet6 from $jail_net6 to any -> (wg0)
nat on em0 inet6 from $jail_net6 to any -> (em0)

# VPN NAT
nat on wg0 inet from $vpn_net to any -> (wg0)
nat on em0 inet from $vpn_net to any -> (em0)

# Forward games ports to its jail (and route to em0)
rdr pass on em0 proto udp from any to any port 30000:40000 -> 192.168.123.11 port 30000:40000                        
rdr pass on em0 proto tcp from any to any port 30000:40000 -> 192.168.123.11 port 30000:40000                        
pass in quick on bridge1 route-to (em0 10.0.0.1) from 192.168.123.11 to any keep state                   
                                                                                                         
pass in all                                                                                              
pass out all