There is an ongoing discussion in the background between the maintainers for more then a year how to get rid of the hw-id node in general and do such a detection once during initial boot.

And similar example, using same interfaces and host, but instead of GRE tunnel, using a Wireguard site to site tunnel:

Example of using flowtables on mater interfaces, and communication between a local host that is on a VLAN (vlan eth2.22 and host 10.22.22.222), and a remote host that is reachable through a GRE tunnel (tunnel established using interface eth0):

By looking at this and the documentation, I do not see any proofs that flowtables support any encapsulation except VLAN and PPPOE.

PR: https://github.com/vyos/vyos-1x/pull/3414

PR https://github.com/vyos/vyos-build/pull/594
PR https://github.com/vyos/vyos-1x/pull/3412

Can you try with newver version?
New fixes were applied.
You can check this tasks:
https://vyos.dev/T6269
https://vyos.dev/T6191

PR https://github.com/vyos/vyos-1x/pull/3411

Ok, that makes sense. Still need to place the tag.

Not all targets have username/password
For example for the future "location"

set system config-management commit-archive aws authentication access-key
set system config-management commit-archive aws authentication secret-key
set system config-management commit-archive aws bucket <my-bucket-name>
set system config-management commit-archive aws path '/'

This way, predefined targets are more preferred.

@peter, did you try various offloading settings for the NIC being used with reboots in between?

Packet drops are still an issue with XCP-ng 8.2.1 and the latest rolling releases, e.g. 1.5-rolling-202404290019. Roughly 7% of pings are dropped and TX-DRP is nonzero. The same rolling release works flawlessly under Proxmox without any TX-DRP show in netstat.