Hi All, I have a setup where I need to SNAT traffic that will be going out via an IPSec tunnel. The NAT must take place before the IPSec encryption+encapsulation, so I need the packet to first go through SNAT and then match an IPSec policy. After being IPSec-ified, I need the packets to go through routing again. My question: SNAT takes place in POST_ROUTING. Can IPSec be applied after that? I have read that after IPSec the packet gets injected to LOCAL_OUT again, but when does the actual IPSec policy decision take place? Won't it happen *before* SNAT? Can I control it? Thanks, Noa
