pfSense

The idea is to check the phase2 networks and check them with every rule we add if route-to is defined and the src/dst falls in any of these rules add a negating rules.

This can be done in kernel too but its too much overhead, so its better in the rules.