In some email I received from der Mouse, sie wrote:
[Charset iso-8859-1 unsupported, filtering to ASCII...]
> When using ipf's "fastroute" option to redirect a packet out an
> interface, what controls the next-hop address used?
> 
> For example, if I do
> 
> 	pass out quick fastroute le1 on le0 from 10.0.0.0/8 to any
> 
> to redirect all traffic that would normally go out le0, but which comes
> from 10/8, out le1 instead, how do I control the next-hop gateway
> address used when sending the packet out le1?  (For example, if the arp
> table for le1 is empty, what controls what address will be arped for?)

pass out quick on le0 to le1:ne.xt.h.op from 10.0.0.0/8 to any

Darren