diff --git a/modules/server/nftables/default.nix b/modules/server/nftables/default.nix
index 7fcbb46..5cb4cb2 100644
--- a/modules/server/nftables/default.nix
+++ b/modules/server/nftables/default.nix
@@ -27,8 +27,12 @@ in{
           ${if cfg.web then ''udp dport {80, 443} accept'' else ""}
           ${if cfg.wireguard then ''tcp dport {1515} accept'' else ""}
           ${if cfg.wireguard then ''udp dport {1515} accept'' else ""}
-          
-          
+        }
+        chain forward {
+          type filter hook forward priority filter; policy drop;
+          ct state established,related accept
+          iifname { "podman*", "veth*" } accept
+          oifname { "podman*", "veth*" } accept
         }
       }
       ${if cfg.nftables.enable then ''