diff --git a/image/overlay/etc/nftables.nft b/image/overlay/etc/nftables.nft
index e4be3fb..68ea898 100644
--- a/image/overlay/etc/nftables.nft
+++ b/image/overlay/etc/nftables.nft
@@ -70,6 +70,12 @@ table inet filter {
 
 	chain forward {
 		type filter hook forward priority 0; policy accept;
+		ip daddr 10.0.0.119 tcp dport {80, 443} accept
+		ip daddr 10.0.0.119 udp dport 443 accept
+		# block LAN access from containers.
+	    ip daddr 10.0.0.0/24 drop
+		ip daddr 192.168.0.0/16 drop
+		ip daddr 172.16.0.0/12 drop
 	}
 
 	chain output {
@@ -81,4 +87,4 @@ table inet filter {
 include "/var/lib/nftables/*.nft"
 
 # Rules
-include "/etc/nftables.d/*.nft"
\ No newline at end of file
+include "/etc/nftables.d/*.nft"