OpenBSD's iked daemon does this by default. Whenever an IPv4 flow is established unencrypted IPv6 traffic is blocked. See the -6 option to iked, which disables

OpenBSD's iked daemon does this by default. Whenever an IPv4 flow is established unencrypted IPv6 traffic is blocked. See the -6 option to iked, which disables this behavior, at https://man.openbsd.org/iked https://man.openbsd.org/iked OTOH, it took several hours of banging my head against the wall to understand why IPv6 stopped working after IPSec tunnels came up.