arp: handle ARP proxy after tunnelling