use any router for second hop of tunnel