Incoming packets communicated over a common WAN interface of a distributed host device may be processed differently depending on their traffic classification. A virtual forwarding unit classifies incoming packets as tunneled traffic, tunnel-related control traffic, remote agent traffic, or local internet traffic. Tunneled traffic classifies packets transported over data or control tunnels extending between WAN interfaces of distributed host devices. Tunnel-related control traffic classifies packets communicated to measure a quality parameter of the data or control tunnels, such as operations, administration and maintenance (OAM) packets. Remote agent traffic classifies packets associated with existing remote agent sessions, which are created and tracked based on outgoing management traffic originating from the virtual remote agent. Local internet traffic classifies packets associated with existing local internet sessions, which are created and tracked based on outgoing local internet traffic.