tunnel: introducing variable tunnel_cmd