> ep0 should not be a "strong host" interface (at least according to my
> understanding of the definition that's evolved here), but instead a
> "strong router" interface.  and the stuff that you want to block
> should probably be filtered...
> 
> ...oh wait.  you're using a cable modem with nat, right?

Close. I'm using a cable modem with a tunnelled subnet or two.  But
the bottom line is the same -- I want to *look* like a single host to
the immediately connected upstream network.