Use ipfilter instead of pf and let ezjail automatically create the ip aliases for the jails on lo1.
Add pkgng config to base flavour.
Modern ssh doesn't need netcat for the proxycommand.
Give jails a few more permissons and specify shutdown script.

This makes ping and postgresql work in jails. Ideally mr.awsome.ezjail will support setting these per jail instead of setting them here globally.