use ExitOnForwardFailure on tunnel example
fixup