ipsec: add input node bypass/discard functionality