ipsec: enable input features on tunnels