diff --git a/tunnel/tunnel.go b/tunnel/tunnel.go
index aec6da01..92615900 100644
--- a/tunnel/tunnel.go
+++ b/tunnel/tunnel.go
@@ -416,6 +416,7 @@ func match(metadata *C.Metadata) (C.Proxy, C.Rule, error) {
 				continue
 			}
 
+			// only unwrap one group, multi-layer nesting will be invalid
 			if adapter.Type() == C.Pass || (adapter.Unwrap(metadata) != nil && adapter.Unwrap(metadata).Type() == C.Pass) {
 				log.Debugln("%s match Pass rule", adapter.Name())
 				continue