extern =  "{ ! 10.0.0.0/8, 10.1.2.3 }"
block out log on tun1000001 from $extern to any