Hack!@#$%


Use stupid routing trick instead:

Resolve next-hop for target

Route target to loopback address

Sniff packets on loopback device

Mangle, send directly to next-hop