2.2.2 Tunnel exit check and data flow

The ultimate packets that are emerging from the tunnels should be checked by a netfilter. There are a number of different ways to do this:

• the packet can be dropped back into the backlog queue, possibly with additional marks for firewalling
• the packet can be run through the input hooks directly, having been marked properly.
• the packet can be a private netfilter hook applied and then be inserted after the input filters.