Pass-to-master flow rule doesn't work for IPsec traffic