VImage allows you to create virtual network stacks, and assign them to Jails. Thus, you get separate IPs for each jail, along with separate instances of packet filters (if needed). Then you can use PF+ALTQ, or IPFW+Dummynet in the host to do traffic shaping/throttling as needed.
