diff --git a/incus.nix b/incus.nix
index c63dde3..214ef9a 100644
--- a/incus.nix
+++ b/incus.nix
@@ -10,6 +10,9 @@
         chain fwd_pre {
           type filter hook forward priority -200; policy accept;
 
+          # Antworten auf vom LAN aufgebaute Verbindungen erlauben (Tailscale-Hairpin)
+          ct state established,related accept
+
           # Crusader-Netz darf NICHT ins LAN
           iifname "incusbr1" ip daddr 192.168.0.0/16 drop
         }