I think the sane default is to check whether the source is authorised, then take action. If they're authorised, allow anything. Else, allow only DNS and ARP to passthrough (perhaps with some kind of metering to prevent abuse of these protocols), and do the IP redirect we currently do.

On the OP: I simply shifted the logic around. This patch was not targetted at this debate, it was intended to retain the same behaviour as before, except for the feature of "authentication works".