1 iptables -t filter -A INPUT -m policy --dir out --strict --spi 0xbeef --proto esp --mode transport -j ACCEPT
2 iptables -t filter -A INPUT -m policy --mode tunnel --tunnel-src 192.168.1.2 --tunnel-dst 192.168.2.1 -j ACCEPT
3 iptables -t filter -A INPUT -m policy --next -j DROP
