diff --git a/config/etc/nftables.conf b/config/etc/nftables.conf
index 4d40ea4..b71d218 100644
--- a/config/etc/nftables.conf
+++ b/config/etc/nftables.conf
@@ -36,6 +36,9 @@ table ip filter {
 
         # overlay network traffic
         udp dport 4789 accept
+        
+        # allow IPSEC connections (encrypted overlay networks)
+        ip protocol esp accept
     }
     chain FORWARD {
         type filter hook forward priority 0;