Network isolation of process using rdomain rtable

[e1-531g]

Hello,
I have started today topic on misc, but maybe here somebody
who is not subscribed to misc can help.
https://marc.info/?i=xvwykxmpbmuapsqsujlt%20()%20xbzl

I would like to isolate process using rtable/rdomain.
By isolation I mean only isolate from network.
I would like to achieve that every packet which is trying
to go through egress would go through pair1 interface,
maybe pair2 interface and then it will be
directed/redirected/nat-ed/forced
(I don't know which word/action is appropriate)
to arrive at port 9191 on pair2 interface.
Now I have something
that seems to work, but maybe there is something to improve?
Maybe there is some error/fault on my side and it
is going to leak some packets? I would like to prevent that.

This is something that I have now:

cat /etc/hostname.pair*
inet 172.10.0.1 255.255.255.0 172.10.0.255 rdomain 1 \
description "An isolated Ethernet"
inet 172.10.0.2 255.255.255.0 172.10.0.255

patched together

ifconfig pair1 patch pair2

with default route:

route -T1 add default 172.10.0.2

Server command:

/usr/local/bin/sudo -u user /usr/bin/nc -4 -k -n -l 172.10.0.2 9191

Commands for programs I would like to intercept/redirect:

#!/bin/sh
/usr/local/bin/sudo /sbin/route -T1 exec /usr/local/bin/sudo \
-u user /usr/bin/nc -4 -n -v 172.10.0.2 9191

random port

#!/bin/sh
/usr/local/bin/sudo /sbin/route -T1 exec /usr/local/bin/sudo \
-u user /usr/bin/nc -4 -n -v 172.10.0.2 9192

random IP and port (this is Google, don't hack)

#!/bin/sh
/usr/local/bin/sudo /sbin/route -T1 exec /usr/local/bin/sudo \
-u user /usr/bin/nc -4 -n -v 212.191.227.88 80

Packet filter rule file and actual rules from pfctl:

#cat pf.conf:
pass in quick  on pair2 inet proto tcp from pair1 \
rdr-to pair2 port 9191 keep state (floating)
pass in
pass out

#pfctl -sr             
pass in quick on pair2 inet proto tcp from 172.10.0.1 \
to any flags S/SA tag rdr_tor_tcp rdr-to 172.10.0.2 port 9191
pass in all flags S/SA
pass out all flags S/SA