how to restrict untagged packet at dot1q-tunnel interface ?

The preceding configuration changes the link type of the interface to dot1q-tunnel. A dot1q-tunnel interface adds a VLAN tag to packets before forwarding them, regardless of the original VLAN IDs of the packets. Before sending a packet, a dot1q-tunnel interface removes the tag with the default VLAN ID from the packet

If you want to send traffic with specific VLAN IDs, you may use following

Quidway-GigabitEthernet1/0/1] port link-type trunk
[Quidway-GigabitEthernet1/0/1] port trunk pvid vlan 20
[Quidway-GigabitEthernet1/0/1] port trunk allow-pass vlan 2 10 20

The preceding configuration changes the link type of the interface to trunk.

A trunk interface processes packets as follows:

• When receiving an untagged packet:

             The interface tags the packet with the default VLAN ID. If the default VLAN ID is in the list of allowed VLAN IDs, the interface accepts the packet.
             The interface tags the packet with the default VLAN ID. If the default VLAN ID is not in the list of allowed VLAN IDs, the interface drops the packet.

• When receiving a tagged packet:

             If the VLAN ID of the packet is in the list of allowed VLAN IDs, the interface accepts the packet.
             If the VLAN ID of the packet is not in the list of allowed VLAN IDs, the interface drops the packet.

• When sending a packet:

             If the VLAN ID of the packet is the same as the default VLAN and is in the list of allowed VLAN IDs, the interface removes the tag from the packet and sends the packet.
             If the VLAN ID of the packet is different from the default VLAN and is in the list of allowed VLAN IDs, the interface retains the tag and sends the packet.

Hello Kolli,
You are recommended to use the selective QinQ rather than the basic QinQ. With selective QinQ, you can set the interface default vlan to, for example, 400, and don't allow the default vlan passing through the switch.