Followup: While the tunnel starts working if I remove ip4csum, the system won't route traffic from the tunnel to any local networks (on the same card as the tunnel or on other interface) or the other direction unless I also remove tcp4csum and udp4csum. Hmmm...