>> pass out quick on le0 to le1:ne.xt.h.op from 10.0.0.0/8 to any
> hmmmm.... thanks for the hint!  I had thought that only worked for
> "dup-to" (and that's the only place it's semi-documented :-)

dup-to, as described, does not do what I wanted.

The doc says "optionally with the destination IP address changed to
that specified".  This sounds to me as though it rewrites ip_dst in the
packet (which seems to me to be the Wrong Thing, even for dup-to).

This is all reminding me of email, with its distinction between
envelope and header recipients.  Using that analogy, I wanted to
specify the envelope-to address, not the header-to, and that's what I
think it should do even for dup-to - but the doc reads as though it
changes the header-to, or at least it's not clear.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       mouse@rodents.montreal.qc.ca
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B