diff --git a/net/bridge.go b/net/bridge.go
index 07567a15..d511b757 100644
--- a/net/bridge.go
+++ b/net/bridge.go
@@ -216,6 +216,7 @@ type BridgeConfig struct {
 	NoBridgedFastdp  bool
 	AWSVPC           bool
 	NPC              bool
+	LegacyNPC        bool
 	MTU              int
 	Mac              string
 	Port             int
@@ -461,20 +462,20 @@ func configureIPTables(config *BridgeConfig, ips ipset.Interface) error {
 		// Ignore error because chains might already exist
 		// TODO(brb): use constants for WEAVE-NPC* chains
 		_ = ipt.NewChain("filter", "WEAVE-NPC")
-		_ = ipt.NewChain("filter", "WEAVE-NPC-EGRESS")
-
-		// TODO(brb): this rule might slow down packet processing; consider removing at it applies only
-		// to node-local traffic.
-		if err = ipt.AppendUnique("filter", "INPUT", "-i", config.WeaveBridgeName, "-j", "WEAVE-NPC-EGRESS"); err != nil {
-			return err
+		if !config.LegacyNPC {
+			_ = ipt.NewChain("filter", "WEAVE-NPC-EGRESS")
+			if err = ipt.AppendUnique("filter", "INPUT", "-i", config.WeaveBridgeName, "-j", "WEAVE-NPC-EGRESS"); err != nil {
+				return err
+			}
+			fwdRules = append(fwdRules, []string{
+				"-i", config.WeaveBridgeName,
+				"-m", "comment", "--comment", "NOTE: this must go before '-j KUBE-FORWARD'",
+				"-j", "WEAVE-NPC-EGRESS"})
 		}
 
 		// If WEAVE-NPC chain doesn't exist then creating a rule in the chain will fail
 		fwdRules = append(fwdRules,
 			[][]string{
-				{"-i", config.WeaveBridgeName,
-					"-m", "comment", "--comment", "NOTE: this must go before '-j KUBE-FORWARD'",
-					"-j", "WEAVE-NPC-EGRESS"},
 				{"-o", config.WeaveBridgeName,
 					"-m", "comment", "--comment", "NOTE: this must go before '-j KUBE-FORWARD'",
 					"-j", "WEAVE-NPC"},
diff --git a/prog/weaver/main.go b/prog/weaver/main.go
index 79c1b65a..93622c5a 100644
--- a/prog/weaver/main.go
+++ b/prog/weaver/main.go
@@ -182,6 +182,7 @@ func main() {
 	mflag.StringVar(&bridgeConfig.WeaveBridgeName, []string{"-weave-bridge"}, "weave", "name of weave bridge")
 	mflag.StringVar(&bridgeConfig.DockerBridgeName, []string{"-docker-bridge"}, "", "name of Docker bridge")
 	mflag.BoolVar(&bridgeConfig.NPC, []string{"-expect-npc"}, false, "set up iptables rules for npc")
+	mflag.BoolVar(&bridgeConfig.LegacyNPC, []string{"-use-legacy-netpol"}, false, "use legacy network policies (pre k8s 1.7 vsn)")
 	mflag.StringVar(&routerName, []string{"-name"}, "", "name of router (defaults to MAC of interface)")
 	mflag.StringVar(&nickName, []string{"-nickname"}, "", "nickname of peer (defaults to hostname)")
 	mflag.StringVar(&password, []string{"-password"}, "", "network password")