Data units are tunneled through topological restrictions that reside in a path between a first network device and a second network device. For example, a remote network device that resides outside of the domain of a multicast group obtains access to the multicast group by tunneling through the boundary of the domain. A proxy device within the domain functions as a member of the multicast group on behalf of the remote network device. Data units that are transmitted from the remote network device to the proxy device are tunneled to the multicast group via the proxy device. Data units that are transmitted from the multicast group to the proxy device are tunneled to the remote network device via the proxy device.