--- ip_input.c.orig     2019-10-26 20:33:21.468834000 +0800
+++ ip_input.c  2019-10-31 08:01:42.938504000 +0800
@@ -37,6 +37,7 @@
#include "opt_bootp.h"
#include "opt_ipstealth.h"
#include "opt_ipsec.h"
+#include "opt_mpath.h"
#include "opt_route.h"
#include "opt_rss.h"

@@ -64,6 +65,9 @@
#include <net/if_dl.h>
#include <net/route.h>
#include <net/netisr.h>
+#ifdef RADIX_MPATH
+#include <net/radix_mpath.h>
+#endif
#include <net/rss_config.h>
#include <net/vnet.h>

@@ -115,6 +119,11 @@
    &VNET_NAME(ipsendredirects), 0,
    "Enable sending IP redirects");

+VNET_DEFINE_STATIC(int, ipfastforward_active) = 1;
+#define V_ipfastforward_active          VNET(ipfastforward_active)
+SYSCTL_INT(_net_inet_ip, OID_AUTO, fastforwarding, CTLFLAG_VNET | CTLFLAG_RW,
+     &VNET_NAME(ipfastforward_active), 0, "Enable fast IP forwarding");
+
/*
 * XXX - Setting ip_checkinterface mostly implements the receive side of
 * the Strong ES model described in RFC 1122, but since the routing table
@@ -566,7 +575,7 @@
        * case skip another inbound firewall processing and update
        * ip pointer.
        */
-       if (V_ipforwarding != 0 && V_ipsendredirects == 0
+       if (V_ipforwarding != 0 && V_ipsendredirects == 0 && V_ipfastforward_active != 0
#if defined(IPSEC) || defined(IPSEC_SUPPORT)
           && (!IPSEC_ENABLED(ipv4) ||
           IPSEC_CAPS(ipv4, m, IPSEC_CAP_OPERABLE) == 0)