I am currently using psad to automatically block potentially harmful IPs. When it detects an attack it adds the ip to PSAD\_BLOCKED\_INPUT or PSAD\_BLOCK\_OUTPUT and then drops all further traffic from this source.

So far so good, but what I want is to redirect the traffic from these blocked IPs to a honeypot running on a VM. Any ideas/suggestions?