[NETFILTER]: Keep conntrack reference until IPsec policy checks are done