filtering outgoing esp traffic with 2.6 stack

Hello,

I'm trying to filter outgoing ipsec traffic with 2.6 stack and do not
know how to do it. As far as I know iptables can see outgoing ipsec
traffic on OUTPUT only as encrypted traffic. This seems to me as
problem, because how I can say that I want to deny ipsec traffic for
some host on my network when the traffic is only seen on OUTPUT as
encrypted?

Thanks,
David