diff --git a/files/etc/local/mesh-firewall/01-tunnels b/files/etc/local/mesh-firewall/01-tunnels
index 8af435fc..a1d5ad06 100755
--- a/files/etc/local/mesh-firewall/01-tunnels
+++ b/files/etc/local/mesh-firewall/01-tunnels
@@ -37,38 +37,57 @@ if [ "$MESHFW_TUNNELS_ENABLED" != "1" ]; then
         exit 0;
 fi
 
-echo "Adding vtun firewall rules..."
-iptables -N zone_vpn_input
-iptables -N zone_vpn_ACCEPT
-iptables -N zone_vpn_DROP
-iptables -N zone_vpn_REJECT
-iptables -N zone_vpn_forward
+# Test for pre-existing firewall rules which use a wildcard and only need setup 1 time for multiple tunnel connections
+if ( $(iptables -L forwarding_vpn 2>/dev/null | egrep "^Chain forwarding_vpn \(.+ references\)" > /dev/null) ) then
+	rules_exist=1
+else
+	rules_exist=0
+fi
+
+# Do nothing on firewall if tunnels already (or still) exist--set up once.
+if [ $rules_exist -eq 0  ] ; then
+	echo "Adding vtun firewall rules..."
+        iptables -N forwarding_vpn
+        iptables -N zone_vpn_input
+        iptables -N zone_vpn_ACCEPT
+        iptables -N zone_vpn_DROP
+        iptables -N zone_vpn_REJECT
+        iptables -N zone_vpn_forward
+        iptables -I delegate_forward 3 -i tun+ -j zone_vpn_forward
+        iptables -I delegate_input 3 -i tun+ -j zone_vpn_input
+        iptables -I delegate_output 3 -j zone_vpn_ACCEPT
+        iptables -A zone_vpn_input -p icmp -m icmp --icmp-type 8 -j ACCEPT
+        iptables -A zone_vpn_input -p tcp -m tcp --dport 2222 -j ACCEPT
+        iptables -A zone_vpn_input -p tcp -m tcp --dport 8080 -j ACCEPT
+        iptables -A zone_vpn_input -p udp -m udp --dport 698 -j ACCEPT
+        iptables -A zone_vpn_input -p tcp -m tcp --dport 1978 -j ACCEPT
+        iptables -A zone_vpn_input -p tcp -m tcp --dport 23 -j ACCEPT
+        iptables -A zone_vpn_input -p tcp -m tcp --dport 9090 -j ACCEPT
+        iptables -A zone_vpn_input -p udp -m udp --dport 161 -j ACCEPT
+        iptables -A zone_vpn_input -j zone_vpn_REJECT
+        iptables -I zone_vpn_forward 1 -j zone_vpn_ACCEPT
+	if [ "$MESHFW_MESHGW" -eq 1 ] ; then
+        	iptables -I zone_vpn_forward -j zone_wan_dest_ACCEPT
+	else
+        	iptables -I zone_vpn_forward -j zone_wan_dest_REJECT
+	fi
+        iptables -A zone_vpn_ACCEPT -o tun+ -j ACCEPT
+        iptables -A zone_vpn_ACCEPT -i tun+ -j ACCEPT
+        iptables -A zone_vpn_DROP -o tun+ -j DROP
+        iptables -A zone_vpn_DROP -i tun+ -j DROP
+        iptables -A zone_vpn_REJECT -o tun+ -j reject
+        iptables -A zone_vpn_REJECT -i tun+ -j reject
+        iptables -A zone_vpn_forward -j zone_dtdlink_dest_ACCEPT
+        iptables -A zone_vpn_forward -j zone_lan_dest_ACCEPT
+        iptables -A zone_vpn_forward -j zone_wifi_dest_ACCEPT
+        iptables -A zone_vpn_forward -j forwarding_vpn
+fi
+
+
+# Rules that modify core tables and as such always need to be executed as they are flushed on reload/restart
 iptables -I delegate_forward 3 -i tun+ -j zone_vpn_forward
 iptables -I delegate_input 3 -i tun+ -j zone_vpn_input
 iptables -I delegate_output 3 -j zone_vpn_ACCEPT
-iptables -A zone_vpn_input -p icmp -m icmp --icmp-type 8 -j ACCEPT
-iptables -A zone_vpn_input -p tcp -m tcp --dport 2222 -j ACCEPT
-iptables -A zone_vpn_input -p tcp -m tcp --dport 8080 -j ACCEPT
-iptables -A zone_vpn_input -p udp -m udp --dport 698 -j ACCEPT
-iptables -A zone_vpn_input -p tcp -m tcp --dport 1978 -j ACCEPT
-iptables -A zone_vpn_input -p tcp -m tcp --dport 23 -j ACCEPT
-iptables -A zone_vpn_input -p tcp -m tcp --dport 9090 -j ACCEPT
 iptables -I zone_dtdlink_forward 1 -j zone_vpn_ACCEPT
 iptables -I zone_lan_forward 1 -j zone_vpn_ACCEPT
 iptables -I zone_wifi_forward 1 -j zone_vpn_ACCEPT
-iptables -I zone_vpn_forward 1 -j zone_vpn_ACCEPT
-if [ "$MESHFW_MESHGW" == "1" ] ; then
-	iptables -I zone_vpn_forward -j zone_wan_dest_ACCEPT
-else
-	iptables -I zone_vpn_forward -j zone_wan_dest_REJECT
-fi
-iptables -A zone_vpn_input -j zone_vpn_ACCEPT
-iptables -A zone_vpn_ACCEPT -o tun+ -j ACCEPT
-iptables -A zone_vpn_ACCEPT -i tun+ -j ACCEPT
-iptables -A zone_vpn_DROP -o tun+ -j DROP
-iptables -A zone_vpn_DROP -i tun+ -j DROP
-iptables -A zone_vpn_REJECT -o tun+ -j reject
-iptables -A zone_vpn_REJECT -i tun+ -j reject
-iptables -A zone_vpn_forward -j zone_dtdlink_dest_ACCEPT
-iptables -A zone_vpn_forward -j zone_lan_dest_ACCEPT
-iptables -A zone_vpn_forward -j zone_wifi_dest_ACCEPT