diff --git a/net/bridge.go b/net/bridge.go
index 2f6d641f..07567a15 100644
--- a/net/bridge.go
+++ b/net/bridge.go
@@ -457,11 +457,24 @@ func configureIPTables(config *BridgeConfig, ips ipset.Interface) error {
 	}
 
 	if config.NPC {
-		// Steer traffic via the NPC
-		_ = ipt.NewChain("filter", "WEAVE-NPC") // ignore error because it might already exist
+		// Steer traffic via the NPC.
+		// Ignore error because chains might already exist
+		// TODO(brb): use constants for WEAVE-NPC* chains
+		_ = ipt.NewChain("filter", "WEAVE-NPC")
+		_ = ipt.NewChain("filter", "WEAVE-NPC-EGRESS")
+
+		// TODO(brb): this rule might slow down packet processing; consider removing at it applies only
+		// to node-local traffic.
+		if err = ipt.AppendUnique("filter", "INPUT", "-i", config.WeaveBridgeName, "-j", "WEAVE-NPC-EGRESS"); err != nil {
+			return err
+		}
+
 		// If WEAVE-NPC chain doesn't exist then creating a rule in the chain will fail
 		fwdRules = append(fwdRules,
 			[][]string{
+				{"-i", config.WeaveBridgeName,
+					"-m", "comment", "--comment", "NOTE: this must go before '-j KUBE-FORWARD'",
+					"-j", "WEAVE-NPC-EGRESS"},
 				{"-o", config.WeaveBridgeName,
 					"-m", "comment", "--comment", "NOTE: this must go before '-j KUBE-FORWARD'",
 					"-j", "WEAVE-NPC"},
diff --git a/weave b/weave
index 56b42719..599afb94 100755
--- a/weave
+++ b/weave
@@ -496,6 +496,10 @@ destroy_bridge() {
     run_iptables -t filter -D FORWARD -o $BRIDGE -m state --state NEW -j NFLOG --nflog-group 86 2>/dev/null || true
     run_iptables -t filter -D FORWARD -o $BRIDGE -j DROP 2>/dev/null || true
     run_iptables -X WEAVE-NPC >/dev/null 2>&1 || true
+    run_iptables -F WEAVE-NPC-EGRESS >/dev/null 2>&1 || true
+    run_iptables -t filter -D FORWARD -o $BRIDGE -j WEAVE-NPC-EGRESS 2>/dev/null || true
+    run_iptables -t filter -D INPUT -i $BRIDGE -j WEAVE-NPC-EGRESS 2>/dev/null || true
+    run_iptables -X WEAVE-NPC-EGRESS >/dev/null 2>&1 || true
 
     run_iptables -F WEAVE-EXPOSE >/dev/null 2>&1 || true
     run_iptables -t filter -D FORWARD -o $BRIDGE -j WEAVE-EXPOSE 2>/dev/null || true