route-to being ignored?

[Jason DiCioccio]

Greetings,
  I'm having a bit of an issue here with pf and the route-to statement on
6.1-RELEASE-p3/i386.


  Basically, I have the following rule (at the top of my rules, no less):

pass out quick route-to ( tun0 10.8.1.5 ) from 66.29.58.71/32 to any

  I've tried this rule with keep state, without keep state, with quick,
without quick, basically everything I could think of.  And I haven't
been able to get this to do anything at all.  Traffic is still flowing
out of ng0 (where the default route resides).

  66.29.58.71 is an IP bound to lo0 on the server.  Traffic for it comes
in over tun0, for which the ifconfig follows:

tun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1500
        inet6 fe80::24a7:3207:1aa1:c985%tun0 prefixlen 64 scopeid 0xa
        inet 10.8.1.6 --> 10.8.1.5 netmask 0xffffffff
        Opened by PID 347

  Currently if I do a tcpdump on ng0, I can see the ICMP Echo replies
going back out over ng0 while the requests come in over tun0.  I should
also note that I haven't been able to get this working with ipfw fwd
either.

  options IPFIREWALL_FORWARD is in the kernel config as well.

  Anyone have any idea what I'm missing?

Thanks!
Jason DiCioccio