isolated "internal" network?

Hi,

I'm planning to deploy a NetBSD/Xen based server with
several services
hosted in separate domains.  Not all domains (e.g. database
server(s),
build server) should have a public IP therefore I'd whish
to have two
separately bridged networks, a public network with public
IP's on bridge0
and an internal network with private IP's on bridge1.  But
I don't want to
connect bridge1 to any physical network device on the dom0. 
What (virtual)
network device can/should I use on the dom0 to communicate
with the private
LAN?  tap, tun, gif, ... ?  

	Geert