In version 1.4.x, we have these IPsec and GRE options for firewall rules matching criteria:
set firewall ipv4 name test rule 10 protocol gre set firewall ipv4 name test rule 10 protocol gre set firewall ipv4 name test rule 10 ipsec match-ipsec (inbound) set firewall ipv4 name test rule 10 ipsec match-none (inbound)
It seems these gre and ipsec option only match incoming packets and not outgoing packets (for the forward hook)
We are looking to have options like those available in the 1.5 rolling version in 1.4.x.
set firewall ipv4 name test rule 10 gre flags set firewall ipv4 name test rule 10 gre inner-proto set firewall ipv4 name test rule 10 gre key set firewall ipv4 name test rule 10 gre version set firewall ipv4 name test rule 10 ipsec match-ipsec-out set firewall ipv4 name test rule 10 ipsec match-none-out set firewall ipv4 name test rule 10 ipsec match-ipsec-in set firewall ipv4 name test rule 10 ipsec match-none-in
With these 1.5 version options we have been able to match outgoing GRE and IPsec traffic for the forward hook.
GRE reference options:
https://github.com/vyos/vyos-1x/pull/3637