Abstract: A system for filtering packets includes a first router, a second router, and a packet filter. The first router encapsulates a packet and transmits the encapsulated packet to the packet filter through a first tunnel. The packet filter receives the encapsulated packet through the first tunnel and de-encapsulates the encapsulated packet. The packet filter then determines whether the de-encapsulated packet is undesirable and, in response to determining that the de-encapsulated packet is not undesirable, encapsulates the de-encapsulated packet and transmits the encapsulated-not-undesirable packet to a second router through a second tunnel. The second router receives the encapsulated-not-undesirable packet from the second tunnel and de-encapsulates the encapsulated-not-undesirable packet.