pascal wrote:

 > Yes, it looks more natural to do it at the ip level (this should be
 > at tcp level, but the routing does not go so high). However,
 > forgive me if I'm wrong here (I am new to netbsd & ipfilter) but
 > doesn't IPF shortcut ip_output sometimes ? (the fastroute stuff)
 >
 > I had the impression that it was talking directly to the interface,
 > in this case. If this is so, then the ipfilter user will not
 > benefit this feature ...

Yes - in ipfr_fastroute and ipflow_fastforward IPFilter calls the
interface output routine directly.  I will have to duplicate the check
and functional call from ip_output.c in these functions as well.  I'm 
afraid I hadn't planned to look at the IPFilter functions until after I 
had ip_output working, but it should be straightforward.

Mike.