diff --git a/image/overlay/etc/nftables.nft b/image/overlay/etc/nftables.nft
index 10be55c..c3e7e12 100644
--- a/image/overlay/etc/nftables.nft
+++ b/image/overlay/etc/nftables.nft
@@ -64,8 +64,9 @@ table inet filter {
 		ip6 saddr fe80::/10 udp sport 547 udp dport 546 accept \
 		comment "Accept DHCPv6 replies from IPv6 link-local addresses"
 
-        tcp dport { 22, 2222 } accept comment "SSH"
+        ip daddr != 172.16.0.0/12 tcp dport { 22, 2222 } accept comment "SSH"
         udp dport 41641 accept comment "Tailscale"
+		ip saddr 172.16.0.0/12 tcp dport 7684 accept comment "bubble management"
 	}
 
 	chain forward {