IPSec and Netfilter

[Jerry Alexander <jerrya@airmail.net>]

Dear NF devel:

         Have just currently  written a user library to implement 
iptables filter and NAT commands.
         Also have written a kernel module that hooks into the PREROUTE 
hook to intercept
packets and collect stats on the IP packet addresses that have been 
entered into iptables.
         Manager just came by and asked me if  Netfilter is above or 
below where IPSEC
resides.    Only know the minimal about IPSEC at this time.  I believe 
his concern is
that  say in tunnel mode,  an IPSEC IP header is built and the contents 
are encrypted and
if Netfilter is below  IPSEC  routing and statistics gathering won't work.
         From browsing the internet,  it appears with the correct 
"iptables NAT command"
that the packet routing will occur correctly.
         I also assume that  when I try to read the packets at the 
PREROUTE point that
it will be the decrypted packet and my statistics gathering will work.
        So far the documentation I have found is not clear on this.
        Could someone knowledgeable in this area please clearify.

                                                                   Thanks,
                                                                             
Jerry