diff --git a/image/overlay/etc/nftables.nft b/image/overlay/etc/nftables.nft
index e20ab14..10be55c 100644
--- a/image/overlay/etc/nftables.nft
+++ b/image/overlay/etc/nftables.nft
@@ -73,11 +73,11 @@ table inet filter {
 		ct state established,related accept
 		ip daddr 10.0.0.1 udp dport 53 accept
 		ip daddr 10.0.0.1 udp dport 41641 accept
+		ip daddr 10.0.0.119 tcp dport 22 drop
 		ip daddr 10.0.0.119 accept
 		# block LAN access from containers.
 	    ip daddr 10.0.0.0/24 drop
 		ip daddr 192.168.0.0/16 drop
-		ip daddr 172.16.0.0/12 drop
 	}
 
 	chain output {