Fix metrics for connections going through SPN

firewall/tunnel.go

@@ -96,6 +96,7 @@ func checkTunneling(ctx context.Context, conn *network.Connection, pkt packet.Pa
 	}
 
 	// Tunnel all the things!
+	conn.SaveWhenFinished()
 
 	// Check if ready.
 	if !captain.ClientReady() {

network/metrics.go

@@ -124,7 +124,7 @@ func (conn *Connection) addToMetrics() {
 		blockedOutConnCounter.Inc()
 		conn.addedToMetrics = true
 		return
-	case VerdictAccept:
+	case VerdictAccept, VerdictRerouteToTunnel:
 		// Continue to next section.
 	default:
 		// Connection is not counted.