pfSense

I created an interface group that includes a routed IPSec VTI interface (ipsec1000). Despite the fact that the VTI interface is a member of the group, traffic coming from the that interface is not evaluated by the interface group rules, traffic is only evaluated based on the Floating and IPSec rule sets (tabs). Being able to add the VTI interface to a group and not having it actually being taken into account when packet filtering occurs is causing confusion.

I see two solutions:
1. Remove the possibility of adding VTI interfaces to interface groups
2. Make the IPsec traffic coming through the VTI interface go through the interface group rules too in this order:
First: Floating
Second: Interface groups the VTI interface is a member of
Third: IPsec tab rules

I would prefer the second one ;-)

Currently, the only way of including the IPsec VTI interface into a group rule is to put all rules in the Floating tab, which is not very convenient.

Thanks.