[HOWTO] Reach your ONT, cable or xDSL modem management interface from your LAN

[bamf]

There's another and - in my opinion - better approach for preventing traffic with private destination addresses from being routed to the ISP:
Create null routes for all private address space. This will blackhole all private destination networks for which no higher priority routes exist. No firewall rules needed.

TIL. Thanks.

Is it possible to reject the blackholed traffic instead of dropping it?

[Netlearn]

Is it possible to reject the blackholed traffic instead of dropping it?

No. It's not dropped, nor rejected. It's just blackholed.

[bamf]

Ok. But this is a route, right? Looking at the documentation https://man.freebsd.org/cgi/man.cgi?query=route

Code Select Expand

    Routes have associated flags which influence  operation  of  the  protocols
    when sending to destinations matched by the routes.  These flags may be set
    (or sometimes cleared) by indicating the following corresponding modifiers:

    -xresolve    RTF_XRESOLVE  - emit mesg on use (for external lookup)
    -iface    ~RTF_GATEWAY    - destination is directly reachable
    -static    RTF_STATIC    - manually added route
    -nostatic ~RTF_STATIC    - pretend route added by kernel or daemon
    -reject    RTF_REJECT    - emit an ICMP unreachable when matched
    -blackhole RTF_BLACKHOLE  - silently discard pkts (during updates)
    -proto1    RTF_PROTO1    - set protocol specific routing flag #1
    -proto2    RTF_PROTO2    - set protocol specific routing flag #2
So what we're using here is -blackhole. Can we use -reject instead?