net/ice: fix flow API tunnel rule