> If I remember the packet flow correctly it is:
 >
 >     ipfilter->ipnat->ipsec->kernel/routing
 >
 > for incoming traffic on each interface.


Obvious I did not. I meant

ipnat->ipfilter->ipsec->kernel/routing

for outgoing its the other way round.