diff --git a/roles/firewall/templates/ip6tables.j2 b/roles/firewall/templates/ip6tables.j2
index 9b6221a..0e44fb9 100644
--- a/roles/firewall/templates/ip6tables.j2
+++ b/roles/firewall/templates/ip6tables.j2
@@ -111,6 +111,10 @@
 -A INPUT -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established inet6" -j ACCEPT
 
 -A INPUT -m comment --comment "default drop inet6" -j LOG_DROP
+
+-A FORWARD -m comment --comment "default forward drop inet6" -j LOG_DROP
+
+-A OUTPUT -m comment --comment "default output accept inet6" -j ACCEPT
 COMMIT
 
 *raw
diff --git a/roles/firewall/templates/iptables.j2 b/roles/firewall/templates/iptables.j2
index 0535f1c..fb66e51 100644
--- a/roles/firewall/templates/iptables.j2
+++ b/roles/firewall/templates/iptables.j2
@@ -95,6 +95,10 @@
 -A INPUT -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established" -j ACCEPT
 
 -A INPUT -m comment --comment "default drop" -j LOG_DROP
+
+-A FORWARD -m comment --comment "default forward drop" -j LOG_DROP
+
+-A OUTPUT -m comment --comment "default output accept" -j ACCEPT
 COMMIT
 
 *raw