sit: strictly restrict incoming traffic to tunnel link device