FreeBSD net.inet.ip.fastforwarding breaks IPSEC tunnels

This is a known design limitation. While the fastforwarding feature brings latency and throughput improvement and it supports most of the normal (slow) IP forwarding path, it does not support IPSEC brokering. See "man 4 inet". Quote: "

Quote:

IPCTL_FASTFORWARDING (ip.fastforwarding) Boolean: enable/disable the use
of fast IP forwarding code. Defaults to off. When
fast IP forwarding is enabled, IP packets are for-
warded directly to the appropriate network inter-
face with direct processing to completion, which
greatly improves the throughput. All packets for
local IP addresses, non-unicast, or with IP options
are handled by the normal IP input processing path.
All features of the normal (slow) IP forwarding
path are supported including firewall (through
pfil(9) hooks) checking, except ipsec(4) tunnel
brokering. The IP fastforwarding path does not
generate ICMP redirect or source quench messages.

In the following scenario where an IPSEC tunnel ending on FreeBSD router, packets will be routed back to the interface towards the default gateway, instead of being routed through the tunnel:

Internet ---- em0 FreeBSD
IPSEC tun ---- enc0 FreeBSD (enc0 is pseudo interface for Ipsec tunnel traffic).

a packet ariving on em0 interface destined for a host behind the tunnel will be routed back to em0 to default gateway.