diff --git a/config/net/upstream.nix b/config/net/upstream.nix
index 494acb5..e04fd18 100644
--- a/config/net/upstream.nix
+++ b/config/net/upstream.nix
@@ -33,11 +33,13 @@ in
         { # http
           destination = servHosts.public-access-proxy;
           proto = "tcp";
+          reflect = true;
           sourcePort = 80;
         }
         { # https
           destination = servHosts.public-access-proxy;
           proto = "tcp";
+          reflect = true;
           sourcePort = 443;
         }
         { # gemini
@@ -49,11 +51,13 @@ in
         {
           destination = servHosts.knot;
           proto = "tcp";
+          reflect = true;
           sourcePort = 53;
         }
         {
           destination = servHosts.knot;
           proto = "udp";
+          reflect = true;
           sourcePort = 53;
         }
         {