The dup-to method does have an immediate drawback, though. Since it has to
make a copy of the packet and optionally modify it for its new destination, it's going to
take a while to complete all this work and be ready to deal with the next packet coming in
to the ipfilter system.
If we don't care about passing the packet to its normal destination and we were going
to block it anyway, we can just use the to keyword to push this packet past the
normal routing table and force it to go out a different interface than it would normally
block in quick on xl0 to ed0 proto tcp from any to any port < 1024
we use block quick for to interface routing, because like fastroute, the to interface code will generate two packet paths through ipfilter when used with pass, and likely cause your system to panic.