A method, comprising: receiving, by a network node, a packet having an inner internet protocol "IP" header and an outer IP header, wherein a source address of the outer IP header identifies a tunnel endpoint of a transmitting network node, and a destination address of the outer IP header identifies a tunnel endpoint of the network node, wherein a source address of the inner IP header identifies a sender address, and a destination address of the inner IP header identifies a recipient address, wherein the inner IP header is encrypted by the transmitting network node; generating, by the network node after receiving the packet, a copy of the packet to obtain a copied packet; performing, by the network node, decryption on either the packet or the copied packet to identify the recipient address of the inner IP header; updating, by the network node, the outer IP header of the packet, if the copied packet was decrypted, or updating, by the network node, the outer IP header of the copied packet, if the packet was decrypted, to obtain an updated packet with an updated outer IP header, wherein the source address of the updated outer IP header is updated to the tunnel endpoint of the network node, and the destination address of the updated outer IP header is updated to a tunnel endpoint of a receiving network node (210-N) that is associated with the recipient address, wherein the network node, the transmitting network node, and the receiving network node share a security association that permits the network node and the receiving network node to decrypt encryption performed by the transmitting network node, and wherein the network node, the transmitting network node, and the receiving network node are associated with a group virtual private network; and routing, by the network node, the updated packet according to the updated outer IP header. receiving, by a network node, a packet having an inner internet protocol "IP" header and an outer IP header, wherein a source address of the outer IP header identifies a tunnel endpoint of a transmitting network node, and a destination address of the outer IP header identifies a tunnel endpoint of the network node, wherein a source address of the inner IP header identifies a sender address, and a destination address of the inner IP header identifies a recipient address, wherein the inner IP header is encrypted by the transmitting network node; wherein a source address of the outer IP header identifies a tunnel endpoint of a transmitting network node, and a destination address of the outer IP header identifies a tunnel endpoint of the network node, wherein a source address of the inner IP header identifies a sender address, and a destination address of the inner IP header identifies a recipient address, wherein the inner IP header is encrypted by the transmitting network node; generating, by the network node after receiving the packet, a copy of the packet to obtain a copied packet; performing, by the network node, decryption on either the packet or the copied packet to identify the recipient address of the inner IP header; updating, by the network node, the outer IP header of the packet, if the copied packet was decrypted, or updating, by the network node, the outer IP header of the copied packet, if the packet was decrypted, to obtain an updated packet with an updated outer IP header, wherein the source address of the updated outer IP header is updated to the tunnel endpoint of the network node, and the destination address of the updated outer IP header is updated to a tunnel endpoint of a receiving network node (210-N) that is associated with the recipient address, wherein the network node, the transmitting network node, and the receiving network node share a security association that permits the network node and the receiving network node to decrypt encryption performed by the transmitting network node, and wherein the network node, the transmitting network node, and the receiving network node are associated with a group virtual private network; and routing, by the network node, the updated packet according to the updated outer IP header.