diff --git a/firewall/tunnel.go b/firewall/tunnel.go
index 79bc592d..32d60de1 100644
--- a/firewall/tunnel.go
+++ b/firewall/tunnel.go
@@ -96,6 +96,7 @@ func checkTunneling(ctx context.Context, conn *network.Connection, pkt packet.Pa
 	}
 
 	// Tunnel all the things!
+	conn.SaveWhenFinished()
 
 	// Check if ready.
 	if !captain.ClientReady() {
diff --git a/network/metrics.go b/network/metrics.go
index 720856ae..7867cea4 100644
--- a/network/metrics.go
+++ b/network/metrics.go
@@ -124,7 +124,7 @@ func (conn *Connection) addToMetrics() {
 		blockedOutConnCounter.Inc()
 		conn.addedToMetrics = true
 		return
-	case VerdictAccept:
+	case VerdictAccept, VerdictRerouteToTunnel:
 		// Continue to next section.
 	default:
 		// Connection is not counted.