tcp between tap interfaces

[dkleinh at phy.ucsf.edu]

I'm trying to setup a private testing environment using the bhyve
hypervisor and some virtual machines connected with tap interfaces
to a bridge.  My network configuration for this environment looks like
this:

I have a bridge interface with 5 tap interfaces, but no real interface as
this is to be virtual.  The bridge interface has interface: 192.168.1.1
This is the gateway for the VMs.  Each tap interface on the (virtual)  
bridge to each VM is on the 192.168.1.0/24 network.  I nat the private  
network out through a real interface on the host.

I use the pf packet filter and nat is working great, each VM can  
connect out to the world.  The host can connect into each VM through  
the bridge and icmp and udp seem to work great between the VMs on the  
private network, but tcp does not seem to work.  That is, I cannot ssh  
between the VMs, but ping works and I've setup a DNS server on one of  
the VMs and that works for resolving the different private VM host  
names and external names.  The host can ssh into each VM OK.

I'm totally at a loss where to go with this.

I'm running FreeBSD 10.1 on the host.