# Tunneler Identity Removal from AppWan Issue **URL:** \ **Category:** Ziti Tunnel\ **Created:** [January 14, 2020, 2:52pm UTC](https://openziti.discourse.group/t/tunneler-identity-removal-from-appwan-issue/90 "2020-01-14T14:52:09Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![dariuszSki](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/dariuszski/32/339_2.png) [@dariuszSki](https://openziti.discourse.group/u/dariuszSki)\ **Post date:** [January 14, 2020, 2:52pm UTC](https://openziti.discourse.group/t/tunneler-identity-removal-from-appwan-issue/90/1 "2020-01-14T14:52:09Z")
We came across an issue with tunneler. This is deployed on minimop - Cloud Engineering Platform. The iptable rules don’t get cleaned up when the tunnneler identity is removed from appwan. Also, UDP rules get created automatically and they don’t get cleaned up at all unless the tunneler app is restarted. ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [January 14, 2020, 2:55pm UTC](https://openziti.discourse.group/t/tunneler-identity-removal-from-appwan-issue/90/2 "2020-01-14T14:55:05Z")
Thanks @dariuszSki - do you have steps to reproduce this problem? Do you know exactly how it’s getting triggered? ---
**Author:** ![dariuszSki](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/dariuszski/32/339_2.png) [@dariuszSki](https://openziti.discourse.group/u/dariuszSki)\ **Post date:** [January 14, 2020, 3:12pm UTC](https://openziti.discourse.group/t/tunneler-identity-removal-from-appwan-issue/90/3 "2020-01-14T15:12:54Z")
ziti version 0.5.6-2510 1. enroll tunneler 2. start tunneler 3. create a service 4. add tunneler identity and service to appwan 5. forwarding rules are configured as expected. 6. remove tunneler identity from appwan 7. forwarding rules are not removed 8. remove service from appwan 9. tcp forwarding rule is removed except for udp rule 10. restart tunneler app 11. udp forwarding rule is removed ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [January 14, 2020, 3:32pm UTC](https://openziti.discourse.group/t/tunneler-identity-removal-from-appwan-issue/90/4 "2020-01-14T15:32:35Z")
> [@dariuszSki](#): > > - warding rules are configured as expected. > - remove tunneler identity from appwan > - forwarding rules are not removed > - remove service from appwan > - tcp forwarding rule is removed except for udp rule > - restart tunneler how long are you waiting? I think the tunneler takes like 5 minutes before it notices a change like removing it from the appwan. ---
**Author:** ![dariuszSki](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/dariuszski/32/339_2.png) [@dariuszSki](https://openziti.discourse.group/u/dariuszSki)\ **Post date:** [January 14, 2020, 3:39pm UTC](https://openziti.discourse.group/t/tunneler-identity-removal-from-appwan-issue/90/5 "2020-01-14T15:39:15Z")
definitely not 5 min, will check again ---
**Author:** ![dariuszSki](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/dariuszski/32/339_2.png) [@dariuszSki](https://openziti.discourse.group/u/dariuszSki)\ **Post date:** [January 14, 2020, 3:51pm UTC](https://openziti.discourse.group/t/tunneler-identity-removal-from-appwan-issue/90/6 "2020-01-14T15:51:04Z")
still the same after more than 5 min. When the service is removed from AppWan, it takes less than 30 seconds to remove the forwarding rules ---
**Author:** ![scareything](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/scareything/32/106_2.png) [@scareything](https://openziti.discourse.group/u/scareything)\ **Post date:** [January 14, 2020, 4:19pm UTC](https://openziti.discourse.group/t/tunneler-identity-removal-from-appwan-issue/90/7 "2020-01-14T16:19:49Z")
I don’t have a 0.5 test environment breathing at the moment, but I’m pretty sure that this issue was fixed with a recent PR that went into 0.7 ([https://github.com/netfoundry/ziti-edge/pull/24](https://github.com/netfoundry/ziti-edge/pull/24)). I’ll double check the behavior in 0.7 to be sure. Standby, ---
**Author:** ![scareything](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/scareything/32/106_2.png) [@scareything](https://openziti.discourse.group/u/scareything)\ **Post date:** [January 14, 2020, 4:32pm UTC](https://openziti.discourse.group/t/tunneler-identity-removal-from-appwan-issue/90/8 "2020-01-14T16:32:47Z")
The issue that you found here exists in 0.7 also. I’ll start a GH issue and fix, and we’ll figure out how to make a 0.5 build available. 🙂 ---
**Author:** ![dariuszSki](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/dariuszski/32/339_2.png) [@dariuszSki](https://openziti.discourse.group/u/dariuszSki)\ **Post date:** [January 14, 2020, 4:34pm UTC](https://openziti.discourse.group/t/tunneler-identity-removal-from-appwan-issue/90/9 "2020-01-14T16:34:29Z")
Sounds good. Thanks! ---
**Author:** ![scareything](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/scareything/32/106_2.png) [@scareything](https://openziti.discourse.group/u/scareything)\ **Post date:** [January 14, 2020, 5:47pm UTC](https://openziti.discourse.group/t/tunneler-identity-removal-from-appwan-issue/90/10 "2020-01-14T17:47:47Z")
I spoke too soon. I was inadvertently running an old 0.7 build that existed before I made the above-mentioned fix. So this issue no longer exists in 0.7. Of course it would be swell if you were willing to upgrade to 0.7 or could live with this issue until you do :)… But we can backport the fix into 0.5 if this is a blocker for you. Let me know.