personally I would not want any tunnel running without a netclient that configured it other than a external client