I don't disagree that this is a Bad Thing. I like to use a BSD based router and a PF firewall. My solution: match in on $i inet proto udp from any to !($i

I don't disagree that this is a Bad Thing. I like to use a BSD based router and a PF firewall. My solution: match in on $i inet proto udp from any to !($i) port {53 123} rdr-to ($i) "Any UDP packet destined for port 53 (DNS) or 123 (NTP) that is not the gateway ("$i"), redirect them to gateway ("$i"). The gateway has daemons listening and caching requests for performance. The client has no idea this is happening. It works great for me.