diff --git a/config/net/upstream.nix b/config/net/upstream.nix
index 450c5bc..5e30fdc 100644
--- a/config/net/upstream.nix
+++ b/config/net/upstream.nix
@@ -173,6 +173,7 @@ in
           destination = config.site.net.core.hosts4.vpn-gw;
           proto = "udp";
           sourcePort = config.site.vpn.wireguard.port;
+          reflect = true;
         }
         {
           destination = servHosts.gnunet;