I'd love to see some examples, too. Would it be useful for a two-stage email setup for example, where something like postfix or opensmtpd was exposed to the int

I'd love to see some examples, too. Would it be useful for a two-stage email setup for example, where something like postfix or opensmtpd was exposed to the internet, and a richer mail service (with more attack surface) was confined to a vfr, and only the "outer" service listen on smtp to the internet, and forward via LMTP to the "inner" service for example?