diff --git a/python/lib/cloudutils/serviceConfig.py b/python/lib/cloudutils/serviceConfig.py
index 36a5e6a572f..1acee497968 100644
--- a/python/lib/cloudutils/serviceConfig.py
+++ b/python/lib/cloudutils/serviceConfig.py
@@ -533,6 +533,8 @@ class firewallConfigAgent(firewallConfigBase):
         self.ports = "22 16509 5900:6100 49152:49216".split()
         if syscfg.env.distribution.getVersion() == "CentOS":
             self.rules = ["-D FORWARD -j RH-Firewall-1-INPUT"]
+        else:
+            self.rules = ["-D FORWARD -j REJECT --reject-with icmp-host-prohibited"]
 
 
 class cloudAgentConfig(serviceCfgBase):