clear-private mismatch should lead to full packet loss and no tunnel