I think the issue is the APP There should design the model like : Per-APP have a tag when go through to the dev Then the dev have a tag bind to the APP So every-APP have a default tag Per-APP1 have tag-a then Dev-vpn have tag-vpn If we need App1 go through to the tag-vpn just using the tag-a bind to tag-vpn Just like a network-link