Interesting traffic goes to WAN

[Eugene]

Interesting problem… Just created new tunnel with the next settings:
                <tunnel><interface>wan</interface>
                        <local-subnet><address>10.1.1.0/24</address></local-subnet>
                        <remote-subnet>192.168.187.0/24</remote-subnet>
                        <remote-gateway>x.x.x.x</remote-gateway>
There is a rule on interface 10.1.1.x to do default routing to 192.168.187.0/24.
But instead of trying to Initiate phase1 pfSense just natted source IP and forwarded packets from 10.1.1.x to 192.168.187.x using WAN interface.
Could not find anything related in forum.
Thanks.</tunnel>