diff --git a/config.xml b/config.xml
index 25f4f8e..8252fa7 100644
--- a/config.xml
+++ b/config.xml
@@ -517,6 +517,28 @@
     </rule>
   </nat>
   <filter>
+    <rule uuid="e035ffc3-9d74-4939-a91c-b3610dcd8507">
+      <associated-rule-id>nat_66294aceae18a9.36912048</associated-rule-id>
+      <source>
+        <any>1</any>
+      </source>
+      <interface>wan</interface>
+      <statetype>keep state</statetype>
+      <protocol>tcp/udp</protocol>
+      <ipprotocol>inet</ipprotocol>
+      <destination>
+        <address>docker_landlab</address>
+        <port>_web_ports</port>
+      </destination>
+      <descr>Forward all external web traffic to docker-landlab npm</descr>
+      <category/>
+      <created>
+        <username>mshillam@10.10.10.20</username>
+        <time>1713982158.7131</time>
+        <description>/firewall_nat_edit.php made changes</description>
+      </created>
+      <log>1</log>
+    </rule>
     <rule uuid="d95bec34-aceb-43d7-8a9d-65edc759f106">
       <type>pass</type>
       <ipprotocol>inet</ipprotocol>
@@ -596,6 +618,33 @@
         <description>/firewall_rules_edit.php made changes</description>
       </created>
     </rule>
+    <rule uuid="814e5df9-543f-466e-a854-d7b964bf1be7">
+      <type>pass</type>
+      <interface>opt1</interface>
+      <ipprotocol>inet46</ipprotocol>
+      <statetype>keep state</statetype>
+      <descr>Allow access from LandLab router LAN to the Internet and block access to everything else</descr>
+      <direction>in</direction>
+      <log>1</log>
+      <quick>1</quick>
+      <protocol>tcp/udp</protocol>
+      <source>
+        <address>LANDLAB</address>
+      </source>
+      <destination>
+        <any>1</any>
+      </destination>
+      <updated>
+        <username>mshillam@10.10.10.20</username>
+        <time>1713985249.8489</time>
+        <description>/firewall_rules_edit.php made changes</description>
+      </updated>
+      <created>
+        <username>mshillam@10.10.10.20</username>
+        <time>1713985249.8489</time>
+        <description>/firewall_rules_edit.php made changes</description>
+      </created>
+    </rule>
     <rule uuid="1533a82e-b6aa-4162-8b16-5e71b46c1a48">
       <type>pass</type>
       <interface>opt1</interface>
@@ -675,28 +724,6 @@
         <description>/firewall_rules_edit.php made changes</description>
       </created>
     </rule>
-    <rule>
-      <associated-rule-id>nat_66294aceae18a9.36912048</associated-rule-id>
-      <source>
-        <any>1</any>
-      </source>
-      <interface>wan</interface>
-      <statetype>keep state</statetype>
-      <protocol>tcp/udp</protocol>
-      <ipprotocol>inet</ipprotocol>
-      <destination>
-        <address>docker_landlab</address>
-        <port>_web_ports</port>
-      </destination>
-      <descr>Forward all external web traffic to docker-landlab npm</descr>
-      <category/>
-      <created>
-        <username>mshillam@10.10.10.20</username>
-        <time>1713982158.7131</time>
-        <description>/firewall_nat_edit.php made changes</description>
-      </created>
-      <log>1</log>
-    </rule>
     <bypassstaticroutes>yes</bypassstaticroutes>
   </filter>
   <rrd>
@@ -756,8 +783,8 @@
   </widgets>
   <revision>
     <username>mshillam@10.10.10.20</username>
-    <time>1713984852.9923</time>
-    <description>/firewall_nat_out.php made changes</description>
+    <time>1713985250.0898</time>
+    <description>/firewall_rules_edit.php made changes</description>
   </revision>
   <OPNsense>
     <wireguard>