How many times is the firewall kernel invoked for a packet to be passed through a VPN connection?

How many times is the firewall kernel invoked for a packet to be passed through a VPN connection?

A.
Three times

B.
Twice

C.
Once

D.
None The IPSO kernel handles it