In version 1.4.x, we have these IPsec and GRE options for firewall rules matching criteria:
```
set firewall ipv4 name test rule 10 protocol gre
set firewall ipv4 name test rule 10 protocol gre
set firewall ipv4 name test rule 10 ipsec match-ipsec (inbound)
set firewall ipv4 name test rule 10 ipsec match-none (inbound)
```
It seems these gre and ipsec option only match incoming packets and not outgoing packets (for the forward hook)
We are looking to have options like those available in the 1.5 rolling version in 1.4.x.
```
set firewall ipv4 name test rule 10 gre flags
set firewall ipv4 name test rule 10 gre inner-proto
set firewall ipv4 name test rule 10 gre key
set firewall ipv4 name test rule 10 gre version
set firewall ipv4 name test rule 10 ipsec match-ipsec-out
set firewall ipv4 name test rule 10 ipsec match-none-out
set firewall ipv4 name test rule 10 ipsec match-ipsec-in
set firewall ipv4 name test rule 10 ipsec match-none-in
```
With these 1.5 version options we have been able to match outgoing GRE and IPsec traffic for the forward hook.
GRE reference options:
https://github.com/vyos/vyos-1x/pull/3637
Case reference (customer needs this matching criteria in 1.4.x version):
https://internal.jira.vyos.com/browse/VTS-2367