diff --git a/host_firewall/templates/host.nft.j2 b/host_firewall/templates/host.nft.j2
index c3f0f43..04ba25e 100644
--- a/host_firewall/templates/host.nft.j2
+++ b/host_firewall/templates/host.nft.j2
@@ -129,9 +129,13 @@ table inet host {
 {% if cluster.v4 is defined and cluster.v4.pods is defined %}
 	# NetBird marks new flows in prerouting (priority mangle, -150) and masquerades marked ones in postrouting, which
 	# rewrites the source of cross-node pod traffic and breaks Cilium identity and network policy when pod traffic passes
-	# the host stack (veth with legacy host routing). This chain runs right after and clears the marks for pod to pod flows.
+	# the host stack (veth with legacy host routing). This chain runs right after. Flows from the cluster ring (pods,
+	# node NetBird addresses) into the pod CIDR arriving on wt0 get mark 0x1bd20: not masqueraded, and accepted by the
+	# NetBird forward filter, which drops forwarded wt0 traffic that no route group allows. Other pod to pod flows
+	# lose their marks.
 	chain pod_identity {
 		type filter hook prerouting priority -140; policy accept;
+		iifname "wt0" ct state new ip saddr @cluster_v4 ip daddr {{ cluster.v4.pods }} meta mark set 0x0001bd20
 		ct state new ip saddr {{ cluster.v4.pods }} ip daddr {{ cluster.v4.pods }} meta mark 0x0001bd21 meta mark set 0
 		ct state new ip saddr {{ cluster.v4.pods }} ip daddr {{ cluster.v4.pods }} meta mark 0x0001bd22 meta mark set 0
 	}