```
# kldunload -nq pf
# kenv net.pf.default_to_drop=1
# kldstat -qm pf && kldunload pf# jail -ic vnet persist
# kldload pf1
# jexec 1 sysctl net.pf.default_to_drop
net.pf.default_to_drop=1
# jexec 1 pfctl -e
# jexec 1 ping -c1 127.0.0.1
PING 127.0.0.1 (127.0.0.1): 56 data bytes
ping: sendto: Permission denied
```