diff --git a/coreapi/TunnelManager.cc b/coreapi/TunnelManager.cc
index 49a6464ef..35927b5e0 100644
--- a/coreapi/TunnelManager.cc
+++ b/coreapi/TunnelManager.cc
@@ -116,7 +116,7 @@ void TunnelManager::start() {
 	mTunnelClient->start();
 }
 
-bool TunnelManager::isStarted() {
+bool TunnelManager::isStarted() const {
 	return mTunnelClient != 0 && mTunnelClient->isStarted();
 }
 
@@ -178,14 +178,10 @@ void TunnelManager::registration(){
 
 	//  tunnel was enabled
 	if (isReady()){
-		linphone_core_set_firewall_policy(mCore,LinphonePolicyNoFirewall);
 		linphone_core_set_rtp_transport_factories(mCore,&mTransportFactories);
 		if(mTunnelizeSipPackets) {
 			sal_enable_tunnel(mCore->sal, mTunnelClient);
 		}
-	// tunnel was disabled
-	} else {
-		linphone_core_set_firewall_policy(mCore, mPreviousFirewallPolicy);
 	}
 
 	// registration occurs always after an unregistation has been made. First we
@@ -209,7 +205,7 @@ void TunnelManager::processTunnelEvent(const Event &ev){
 	}
 }
 
-void TunnelManager::waitUnRegistration(){
+void TunnelManager::waitUnRegistration() {
 	LinphoneProxyConfig* lProxy;
 
 	linphone_core_get_default_proxy(mCore, &lProxy);
@@ -244,11 +240,9 @@ void TunnelManager::enable(bool isEnable) {
 	ms_message("Turning tunnel [%s]", isEnable ?"on" : "off");
 	if (isEnable && !mEnabled){
 		mEnabled=true;
-		//1 save firewall policy
-		mPreviousFirewallPolicy=linphone_core_get_firewall_policy(mCore);
-		//2 unregister
+		//1 unregister
 		waitUnRegistration();
-		//3 insert tunnel
+		//2 insert tunnel
 		start();
 	}else if (!isEnable && mEnabled){
 		//1 unregister
@@ -334,7 +328,7 @@ void TunnelManager::enableLogs(bool isEnabled,LogHandler logHandler) {
 }
 
 
-bool TunnelManager::isEnabled() {
+bool TunnelManager::isEnabled() const {
 	return mEnabled;
 }
 
@@ -414,6 +408,6 @@ void TunnelManager::setHttpProxy(const char *host,int port, const char *username
 	if (mTunnelClient) mTunnelClient->setHttpProxy(host, port, username, passwd);
 }
 
-LinphoneCore *TunnelManager::getLinphoneCore(){
+LinphoneCore *TunnelManager::getLinphoneCore() const{
 	return mCore;
 }
diff --git a/coreapi/TunnelManager.hh b/coreapi/TunnelManager.hh
index 4cd8bff77..0c6f8c5b4 100644
--- a/coreapi/TunnelManager.hh
+++ b/coreapi/TunnelManager.hh
@@ -98,7 +98,7 @@ class UdpMirrorClient;
 		/**
 		 * Returns a boolean indicating whether tunneled operation is enabled.
 		**/
-		bool isEnabled();
+		bool isEnabled() const;
 		/**
 		 * Enables debug logs of the Tunnel subsystem.
 		**/
@@ -145,7 +145,7 @@ class UdpMirrorClient;
 		/**
 		 * Get associated Linphone Core.
 		 */
-		LinphoneCore *getLinphoneCore();
+		LinphoneCore *getLinphoneCore() const;
 		virtual void setHttpProxy(const char *host,int port, const char *username, const char *passwd);
 		virtual bool isReady() const;
 	private:
@@ -161,7 +161,7 @@ class UdpMirrorClient;
 			}mData;
 		};
 		typedef std::list<UdpMirrorClient> UdpMirrorClientList;
-		virtual bool isStarted();
+		virtual bool isStarted() const;
 		void onIterate();
 		static int customSendto(struct _RtpTransport *t, mblk_t *msg , int flags, const struct sockaddr *to, socklen_t tolen);
 		static int customRecvfrom(struct _RtpTransport *t, mblk_t *msg, int flags, struct sockaddr *from, socklen_t *fromlen);
@@ -201,7 +201,6 @@ class UdpMirrorClient;
 		std::string mHttpPasswd;
 		std::string mHttpProxyHost;
 		int mHttpProxyPort;
-		LinphoneFirewallPolicy mPreviousFirewallPolicy;
 		bool mPreviousRegistrationEnabled;
 		bool mTunnelizeSipPackets;
 	};
diff --git a/coreapi/callbacks.c b/coreapi/callbacks.c
index 4a23e5240..89e61bfeb 100644
--- a/coreapi/callbacks.c
+++ b/coreapi/callbacks.c
@@ -292,7 +292,7 @@ static void call_received(SalOp *h){
 	linphone_core_add_call(lc,call);
 	linphone_call_ref(call); /*prevent the call from being destroyed while we are notifying, if the user declines within the state callback */
 
-	if ((linphone_core_get_firewall_policy(lc) == LinphonePolicyUseIce) && (call->ice_session != NULL)) {
+	if ((_linphone_core_get_firewall_policy(lc) == LinphonePolicyUseIce) && (call->ice_session != NULL)) {
 		/* Defer ringing until the end of the ICE candidates gathering process. */
 		ms_message("Defer ringing to gather ICE candidates");
 		return;
diff --git a/coreapi/linphone_tunnel.cc b/coreapi/linphone_tunnel.cc
index e7968d8d7..7a79140d9 100644
--- a/coreapi/linphone_tunnel.cc
+++ b/coreapi/linphone_tunnel.cc
@@ -29,7 +29,7 @@
 #include "private.h"
 #include "lpconfig.h"
 
-LinphoneTunnel* linphone_core_get_tunnel(LinphoneCore *lc){
+LinphoneTunnel* linphone_core_get_tunnel(const LinphoneCore *lc){
 	return lc->tunnel;
 }
 
@@ -45,11 +45,11 @@ extern "C" LinphoneTunnel* linphone_core_tunnel_new(LinphoneCore *lc){
 	return tunnel;
 }
 
-static inline belledonnecomm::TunnelManager *bcTunnel(LinphoneTunnel *tunnel){
+static inline belledonnecomm::TunnelManager *bcTunnel(const LinphoneTunnel *tunnel){
 	return tunnel->manager;
 }
 
-static inline _LpConfig *config(LinphoneTunnel *tunnel){
+static inline _LpConfig *config(const LinphoneTunnel *tunnel){
 	return tunnel->manager->getLinphoneCore()->config;
 }
 
@@ -129,7 +129,7 @@ static LinphoneTunnelConfig *linphone_tunnel_config_from_string(const char *str)
 }
 
 
-static void linphone_tunnel_save_config(LinphoneTunnel *tunnel) {
+static void linphone_tunnel_save_config(const LinphoneTunnel *tunnel) {
 	MSList *elem = NULL;
 	char *tmp = NULL, *old_tmp = NULL, *tc_str = NULL;
 	for(elem = tunnel->config_list; elem != NULL; elem = elem->next) {
@@ -218,7 +218,7 @@ void linphone_tunnel_remove_server(LinphoneTunnel *tunnel, LinphoneTunnelConfig
 	}
 }
 
-const MSList *linphone_tunnel_get_servers(LinphoneTunnel *tunnel){
+const MSList *linphone_tunnel_get_servers(const LinphoneTunnel *tunnel){
 	return tunnel->config_list;
 }
 
@@ -238,11 +238,11 @@ void linphone_tunnel_enable(LinphoneTunnel *tunnel, bool_t enabled){
 	bcTunnel(tunnel)->enable(enabled);
 }
 
-bool_t linphone_tunnel_enabled(LinphoneTunnel *tunnel){
+bool_t linphone_tunnel_enabled(const LinphoneTunnel *tunnel){
 	return bcTunnel(tunnel)->isEnabled();
 }
 
-bool_t linphone_tunnel_connected(LinphoneTunnel *tunnel){
+bool_t linphone_tunnel_connected(const LinphoneTunnel *tunnel){
 	return bcTunnel(tunnel)->isReady();
 }
 
diff --git a/coreapi/linphone_tunnel.h b/coreapi/linphone_tunnel.h
index 08a018833..50e58c7c0 100644
--- a/coreapi/linphone_tunnel.h
+++ b/coreapi/linphone_tunnel.h
@@ -142,7 +142,7 @@ LINPHONE_PUBLIC void linphone_tunnel_remove_server(LinphoneTunnel *tunnel, Linph
  * @param  tunnel object
  * returns a string of space separated list of host:port of tunnel server addresses
  * */
-LINPHONE_PUBLIC const MSList *linphone_tunnel_get_servers(LinphoneTunnel *tunnel);
+LINPHONE_PUBLIC const MSList *linphone_tunnel_get_servers(const LinphoneTunnel *tunnel);
 
 /**
  * @param  tunnel object
@@ -163,13 +163,13 @@ LINPHONE_PUBLIC void linphone_tunnel_enable(LinphoneTunnel *tunnel, bool_t enabl
  * @param  tunnel object
  * Returns a boolean indicating whether tunneled operation is enabled.
 **/
-LINPHONE_PUBLIC bool_t linphone_tunnel_enabled(LinphoneTunnel *tunnel);
+LINPHONE_PUBLIC bool_t linphone_tunnel_enabled(const LinphoneTunnel *tunnel);
 
 /**
  * @param  tunnel object
  * Returns a boolean indicating whether tunnel is connected successfully.
 **/
-LINPHONE_PUBLIC bool_t linphone_tunnel_connected(LinphoneTunnel *tunnel);
+LINPHONE_PUBLIC bool_t linphone_tunnel_connected(const LinphoneTunnel *tunnel);
 
 /**
  * @param  tunnel object
diff --git a/coreapi/linphone_tunnel_stubs.c b/coreapi/linphone_tunnel_stubs.c
index c208dd249..1e0ec88b7 100644
--- a/coreapi/linphone_tunnel_stubs.c
+++ b/coreapi/linphone_tunnel_stubs.c
@@ -29,7 +29,7 @@
 #include "lpconfig.h"
 
 
-LinphoneTunnel* linphone_core_get_tunnel(LinphoneCore *lc){
+LinphoneTunnel* linphone_core_get_tunnel(const LinphoneCore *lc){
 	return lc->tunnel;
 }
 
diff --git a/coreapi/linphonecall.c b/coreapi/linphonecall.c
index 01ae1d74d..74e72cd7e 100644
--- a/coreapi/linphonecall.c
+++ b/coreapi/linphonecall.c
@@ -662,7 +662,7 @@ static void linphone_call_get_local_ip(LinphoneCall *call, const LinphoneAddress
 		}
 		if (res != NULL) freeaddrinfo(res);
 	}
-	if (linphone_core_get_firewall_policy(call->core)==LinphonePolicyUseNatAddress
+	if (_linphone_core_get_firewall_policy(call->core)==LinphonePolicyUseNatAddress
 		&& (ip=linphone_core_get_nat_address_resolved(call->core))!=NULL){
 		strncpy(call->localip,ip,LINPHONE_IPADDR_SIZE);
 		return;
@@ -699,11 +699,11 @@ LinphoneCall * linphone_call_new_outgoing(struct _LinphoneCore *lc, LinphoneAddr
 	linphone_call_init_common(call,from,to);
 	call->params = linphone_call_params_copy(params);
 
-	if (linphone_core_get_firewall_policy(call->core) == LinphonePolicyUseIce) {
+	if (_linphone_core_get_firewall_policy(call->core) == LinphonePolicyUseIce) {
 		call->ice_session = ice_session_new();
 		ice_session_set_role(call->ice_session, IR_Controlling);
 	}
-	if (linphone_core_get_firewall_policy(call->core) == LinphonePolicyUseStun) {
+	if (_linphone_core_get_firewall_policy(call->core) == LinphonePolicyUseStun) {
 		call->ping_time=linphone_core_run_stun_tests(call->core,call);
 	}
 #ifdef BUILD_UPNP
@@ -802,7 +802,7 @@ LinphoneCall * linphone_call_new_incoming(LinphoneCore *lc, LinphoneAddress *fro
 		// In this case WE chose the media parameters according to policy.
 		linphone_call_set_compatible_incoming_call_parameters(call, md);
 	}
-	fpol=linphone_core_get_firewall_policy(call->core);
+	fpol=_linphone_core_get_firewall_policy(call->core);
 	/*create the ice session now if ICE is required*/
 	if (fpol==LinphonePolicyUseIce){
 		if (md){
@@ -1457,7 +1457,7 @@ static void port_config_set_random_choosed(LinphoneCall *call, int stream_index,
 
 static void _linphone_call_prepare_ice_for_stream(LinphoneCall *call, int stream_index, bool_t create_checklist){
 	MediaStream *ms=stream_index == 0 ? (MediaStream*)call->audiostream : (MediaStream*)call->videostream;
-	if ((linphone_core_get_firewall_policy(call->core) == LinphonePolicyUseIce) && (call->ice_session != NULL)){
+	if ((_linphone_core_get_firewall_policy(call->core) == LinphonePolicyUseIce) && (call->ice_session != NULL)){
 		IceCheckList *cl;
 		rtp_session_set_pktinfo(ms->sessions.rtp_session, TRUE);
 		rtp_session_set_symmetric_rtp(ms->sessions.rtp_session, FALSE);
@@ -1478,7 +1478,7 @@ int linphone_call_prepare_ice(LinphoneCall *call, bool_t incoming_offer){
 	SalMediaDescription *remote = NULL;
 	bool_t has_video=FALSE;
 
-	if ((linphone_core_get_firewall_policy(call->core) == LinphonePolicyUseIce) && (call->ice_session != NULL)){
+	if ((_linphone_core_get_firewall_policy(call->core) == LinphonePolicyUseIce) && (call->ice_session != NULL)){
 		if (incoming_offer){
 			remote=sal_call_get_remote_media_description(call->op);
 			has_video=call->params->has_video && linphone_core_media_description_contains_video_stream(remote);
@@ -3018,7 +3018,7 @@ static LinphoneAddress *get_fixed_contact(LinphoneCore *lc, LinphoneCall *call ,
 	const char *localip=call->localip;
 
 	/* first use user's supplied ip address if asked*/
-	if (linphone_core_get_firewall_policy(lc)==LinphonePolicyUseNatAddress){
+	if (_linphone_core_get_firewall_policy(lc)==LinphonePolicyUseNatAddress){
 		ctt=linphone_core_get_primary_contact_parsed(lc);
 		linphone_address_set_domain(ctt,linphone_core_get_nat_address_resolved(lc));
 		ret=ctt;
diff --git a/coreapi/linphonecore.c b/coreapi/linphonecore.c
index 606b5ea94..6e6d3f7f2 100644
--- a/coreapi/linphonecore.c
+++ b/coreapi/linphonecore.c
@@ -2607,12 +2607,12 @@ LinphoneCall * linphone_core_invite_address_with_params(LinphoneCore *lc, const
 	call->log->start_date_time=time(NULL);
 	linphone_call_init_media_streams(call);
 
-	if (linphone_core_get_firewall_policy(call->core) == LinphonePolicyUseIce) {
+	if (_linphone_core_get_firewall_policy(call->core) == LinphonePolicyUseIce) {
 		/* Defer the start of the call after the ICE gathering process. */
 		if (linphone_call_prepare_ice(call,FALSE)==1)
 			defer=TRUE;
 	}
-	else if (linphone_core_get_firewall_policy(call->core) == LinphonePolicyUseUpnp) {
+	else if (_linphone_core_get_firewall_policy(call->core) == LinphonePolicyUseUpnp) {
 #ifdef BUILD_UPNP
 		if (linphone_core_update_upnp(lc,call)<0) {
 			/* uPnP port mappings failed, proceed with the call anyway. */
@@ -4463,9 +4463,23 @@ void linphone_core_set_firewall_policy(LinphoneCore *lc, LinphoneFirewallPolicy
 		lp_config_set_string(lc->config,"net","firewall_policy",policy);
 }
 
-LinphoneFirewallPolicy linphone_core_get_firewall_policy(const LinphoneCore *lc){
-	const char *policy = lp_config_get_string(lc->config, "net", "firewall_policy", NULL);
+inline LinphoneFirewallPolicy linphone_core_get_firewall_policy(const LinphoneCore *lc) {
+	return _linphone_core_get_firewall_policy_with_lie(lc, FALSE);
+}
 
+inline LinphoneFirewallPolicy _linphone_core_get_firewall_policy(const LinphoneCore *lc) {
+	return _linphone_core_get_firewall_policy_with_lie(lc, TRUE);
+}
+
+LinphoneFirewallPolicy _linphone_core_get_firewall_policy_with_lie(const LinphoneCore *lc, bool_t lie){
+	const char *policy;
+	if(lie) {
+		LinphoneTunnel *tunnel = linphone_core_get_tunnel(lc);
+		if(tunnel != NULL && linphone_tunnel_enabled(tunnel)) {
+			return LinphonePolicyNoFirewall;
+		}
+	}
+	policy = lp_config_get_string(lc->config, "net", "firewall_policy", NULL);
 	if ((policy == NULL) || (strcmp(policy, "0") == 0))
 		return LinphonePolicyNoFirewall;
 	else if ((strcmp(policy, "nat_address") == 0) || (strcmp(policy, "1") == 0))
diff --git a/coreapi/linphonecore.h b/coreapi/linphonecore.h
index 6029f86af..778bdc2dd 100644
--- a/coreapi/linphonecore.h
+++ b/coreapi/linphonecore.h
@@ -2754,7 +2754,7 @@ typedef struct _LinphoneTunnel LinphoneTunnel;
 /**
 * get tunnel instance if available
 */
-LINPHONE_PUBLIC	LinphoneTunnel *linphone_core_get_tunnel(LinphoneCore *lc);
+LINPHONE_PUBLIC	LinphoneTunnel *linphone_core_get_tunnel(const LinphoneCore *lc);
 
 LINPHONE_PUBLIC void linphone_core_set_sip_dscp(LinphoneCore *lc, int dscp);
 LINPHONE_PUBLIC int linphone_core_get_sip_dscp(const LinphoneCore *lc);
diff --git a/coreapi/private.h b/coreapi/private.h
index 7d1fc0770..b19682718 100644
--- a/coreapi/private.h
+++ b/coreapi/private.h
@@ -281,6 +281,20 @@ void linphone_core_update_proxy_register(LinphoneCore *lc);
 void linphone_core_refresh_subscribes(LinphoneCore *lc);
 int linphone_core_abort_call(LinphoneCore *lc, LinphoneCall *call, const char *error);
 const char *linphone_core_get_nat_address_resolved(LinphoneCore *lc);
+/**
+ * @brief Equivalent to _linphone_core_get_firewall_policy_with_lie(lc, TRUE)
+ * @param lc LinphoneCore instance
+ * @return Fairewall policy
+ */
+LinphoneFirewallPolicy _linphone_core_get_firewall_policy(const LinphoneCore *lc);
+/**
+ * @brief Get the firwall policy which has been set.
+ * @param lc Instance of LinphoneCore
+ * @param lie If true, the configured firewall policy will be returned only if no tunnel are enabled.
+ * Otherwise, NoFirewallPolicy value will be returned.
+ * @return The firewall policy
+ */
+LinphoneFirewallPolicy _linphone_core_get_firewall_policy_with_lie(const LinphoneCore *lc, bool_t lie);
 
 int linphone_proxy_config_send_publish(LinphoneProxyConfig *cfg, LinphonePresenceModel *presence);
 void linphone_proxy_config_set_state(LinphoneProxyConfig *cfg, LinphoneRegistrationState rstate, const char *message);