>>     block in log on ex0_noipsec all head 110
>Maybe it can be made slightly more general by adding canonical tap/filter
>only interfaces and making "tap0" attach to "ex0" at tap point "noipsec"
>with a userland utility and then 

	additional interface breaks IPv6 scoping.  please don't do that.

itojun