you have created your tunnel interface in the untrust zone traffic from the trust zone is able to enter the tunnel and pass to the destination