[HOWTO] Reach your ONT, cable or xDSL modem management interface from your LAN

[bamf]

There's another and - in my opinion - better approach for preventing traffic with private destination addresses from being routed to the ISP:
Create null routes for all private address space. This will blackhole all private destination networks for which no higher priority routes exist. No firewall rules needed.

TIL. Thanks.

Is it possible to reject the blackholed traffic instead of dropping it?

[Netlearn]

Is it possible to reject the blackholed traffic instead of dropping it?

No. It's not dropped, nor rejected. It's just blackholed.

[bamf]

Ok. But this is a route, right? Looking at the documentation https://man.freebsd.org/cgi/man.cgi?query=route

Code Select Expand

    Routes have associated flags which influence  operation  of  the  protocols
    when sending to destinations matched by the routes.  These flags may be set
    (or sometimes cleared) by indicating the following corresponding modifiers:

    -xresolve    RTF_XRESOLVE  - emit mesg on use (for external lookup)
    -iface    ~RTF_GATEWAY    - destination is directly reachable
    -static    RTF_STATIC    - manually added route
    -nostatic ~RTF_STATIC    - pretend route added by kernel or daemon
    -reject    RTF_REJECT    - emit an ICMP unreachable when matched
    -blackhole RTF_BLACKHOLE  - silently discard pkts (during updates)
    -proto1    RTF_PROTO1    - set protocol specific routing flag #1
    -proto2    RTF_PROTO2    - set protocol specific routing flag #2
So what we're using here is -blackhole. Can we use -reject instead?

[meyergru]

The point is that in the route section of the web UI, you can define a route to an existing gateway or to a predefined "Null4" or "Null6" gateway.

The way the route is created seems to be bound by using these specific entries and they use the B (blackhole) flag, you can see this results in "USB" flags for the route.

Since you cannot set the "Reject" flag for a self-defined gateway either, I do not see any way to to this via the web UI. So your are left with either a feature request on Github or by creating a specific pf entry by other means than the web UI.