Methods, apparatus, and systems are provided for processing packets between a first and a second network. When a packet is received from the first network, information for routing the first packet is identified. Based on a first set of rules for processing the first packet and the information for routing the first packet, a second packet encapsulated within the first packet is detected. In the first packet, information for routing the second packet is identified based on which a second set of rules for processing the second packet and an index are determined. The second packet is then filtered based on the index, the second set of rules, and the information for routing the second packet. In addition, the index is associated with any additional packets encapsulated within the second packet. The additional packets are also filtered based on the index and the second set of rules.