the iptables is a hunch because flushing the nft rules sometimes helps, but I have no concrete evidence, maybe the other thing to be aware of is it's ipsec on top of GENEVE as the tunneling protocol