rc.route and an rc.ifc *inside* the jail. The rc.ifc does not setup
interfaces, but does call invoke rc.route (constructed from
virt_routes table by talking to tmcd) for each interface (okay, IP
address) the jail has access to. This is how it works outside the
jail, and I keep the structure inside the jail looking just like it
does outside the jail, of possible.