Some thoughts:
- I am a little confused by the tcpdump output. It looks like it is showing SYN -> SYN -> ACK. (Should be SYN -> SYN-ACK -> ACK.)
- It would probably be worthwhile to post the output of
% sockstat -4l (instead of the netstat output you posted).
- apache22-peruser-mpm is just a module, right? You must also have apache web server installed. (That's how it appears to me on freshports anyway.)
Anyway, some basic questions:
- Is networking set up properly for the jail? Can you try a tcp connect scan from the jail to another host your network? e.g.
% nc -zvw 1 host.here 22
- Are you running any packet filtering firewall on the host?
- Could you triple check to make sure httpd.conf is really logging to /var/log/httpd-access.log?