diff --git a/modules/system/networking.nix b/modules/system/networking.nix
index e718735..dbc1290 100644
--- a/modules/system/networking.nix
+++ b/modules/system/networking.nix
@@ -6,6 +6,7 @@
     nftables.enable = true;
     firewall = {
       enable = true;
+      checkReversePath = "loose";          # exit nodes/subnet routes need loose RPF
       trustedInterfaces = [ "tailscale0" ];
       allowedUDPPorts = [ config.services.tailscale.port ];
     };