diff --git a/entry/src/kni_entry.cpp b/entry/src/kni_entry.cpp
index 9751217..8830659 100644
--- a/entry/src/kni_entry.cpp
+++ b/entry/src/kni_entry.cpp
@@ -1565,6 +1565,8 @@ extern "C" char kni_tcpall_entry(struct streaminfo *stream, void** pme, int thre
 	int ret;
 	int can_destroy;
 	struct pme_info *pmeinfo = *(struct pme_info **)pme;
+	unsigned short stream_tunnel_type = STREAM_TUNNLE_NON;
+	int stream_tunnel_type_len = sizeof(unsigned short);
 	/*  a_packet == NULL && not op_state_close, continue
 		close: a_packet may be null, if a_packet = null, do not send to tfe
 	*/
@@ -1577,6 +1579,14 @@ extern "C" char kni_tcpall_entry(struct streaminfo *stream, void** pme, int thre
 		KNI_LOG_ERROR(logger, "addr_type(%d) is not ipv4 or ipv6, bypass stream");
 		return APP_STATE_FAWPKT | APP_STATE_DROPME;
 	}
+
+	ret=MESA_get_stream_opt(stream, MSO_STREAM_TUNNEL_TYPE, (void *)&stream_tunnel_type, &stream_tunnel_type_len);
+	if(ret != STREAM_TUNNLE_NON)
+	{
+		KNI_LOG_DEBUG(logger, "stream type is tunnel, type = %d",ret);
+		return APP_STATE_FAWPKT | APP_STATE_DROPME;
+	}
+
 	switch(stream->pktstate){
 		case OP_STATE_PENDING:
 			//FS_operate(g_kni_fs_handle->handle, g_kni_fs_handle->fields[KNI_FIELD_STATE_PENDING], 0, FS_OP_ADD, 1);