> The only downside is that it won't stop UDP packets from getting to a UDP listener. There will not be a response but the application will still see it.

Try:

  ip route add src ${net} blackhole