vxlan: Protect against tunnel config where source is not local