net/ice/base: fix tunnel filtering rule