diff --git a/meta-google/recipes-google/ncsi/files/50-ncsi.rules.in b/meta-google/recipes-google/ncsi/files/50-ncsi.rules.in
new file mode 100644
index 0000000..33031f0
--- /dev/null
+++ b/meta-google/recipes-google/ncsi/files/50-ncsi.rules.in
@@ -0,0 +1,14 @@
+table inet filter {
+    chain ncsi_input {
+        type filter hook input priority 0; policy drop;
+        iifname != @NCSI_IF@ accept
+        ct state established accept
+        tcp dport 3959 accept
+        udp dport 3959 accept
+        tcp dport 3967 accept
+        udp dport 3967 accept
+        icmpv6 type nd-neighbor-advert accept
+        icmpv6 type nd-neighbor-solicit accept
+        icmpv6 type nd-router-advert accept
+    }
+}
diff --git a/meta-google/recipes-google/ncsi/ncsid-config.bb b/meta-google/recipes-google/ncsi/ncsid-config.bb
index 339ce2f..17a88f1 100644
--- a/meta-google/recipes-google/ncsi/ncsid-config.bb
+++ b/meta-google/recipes-google/ncsi/ncsid-config.bb
@@ -1,6 +1,7 @@
-SUMMARY = "Configures ncsid for a gBMC system"
+SUMMARY = "Configures ncsid for a system"
 PR = "r1"
-LICENSE = "CLOSED"
+LICENSE = "Apache-2.0"
+LIC_FILES_CHKSUM = "file://${COREBASE}/meta/files/common-licenses/Apache-2.0;md5=89aea4e17d99a7cacdbeed46a0096b10"
 
 inherit systemd