diff --git a/modules/firewall/service.nix b/modules/firewall/service.nix
index 2b88b73..c64e09f 100644
--- a/modules/firewall/service.nix
+++ b/modules/firewall/service.nix
@@ -72,7 +72,7 @@ let
                 local n = output(s, "ifname");
                 local bw = output(s, "bandwidth");
                 if n and bw then
-                  return "icmp iifname ".. n .. " limit rate over " .. (math.floor (tonumber(bw) / 8 / 20)) .. " bytes/second drop"
+                  return "meta l4proto icmp iifname ".. n .. " limit rate over " .. (math.floor (tonumber(bw) / 8 / 20)) .. " bytes/second drop"
                 else
                   return "# " .. (n or "not n") .. " " .. (bw or "not bw")
                 end