In Linux iptables, it is possible to insert a rule like this:
iptables -A INPUT -i eth0 -m policy --dir in --pol ipsec --mode tunnel -j ipsecinput
It will pickup packets on eth0 (the external interface in this case) that are IPsec encrypted, and send those to
the chain “ipsecinput” where they can be further examined. Similar for the FORWARD chain.
What is the equivalent on RouterOS?