isolated "internal" network?

[Geert Hendrickx <ghen%NetBSD.org@localhost>]

Hi,

I'm planning to deploy a NetBSD/Xen based server with several services
hosted in separate domains.  Not all domains (e.g. database server(s),
build server) should have a public IP therefore I'd whish to have two
separately bridged networks, a public network with public IP's on bridge0
and an internal network with private IP's on bridge1.  But I don't want to
connect bridge1 to any physical network device on the dom0.  What (virtual)
network device can/should I use on the dom0 to communicate with the private
LAN?  tap, tun, gif, ... ?  

        Geert