diff --git a/hieradata/roles/infra/network/router.yaml b/hieradata/roles/infra/network/router.yaml
index 91ef40b..e3d35ae 100644
--- a/hieradata/roles/infra/network/router.yaml
+++ b/hieradata/roles/infra/network/router.yaml
@@ -11,6 +11,10 @@ sysctl::base::values:
     value: '0'
   net.ipv4.conf.default.rp_filter:
     value: '0'
+  # overrides 50-redhat.conf's per-interface rp_filter=1 (applied by udev on link add); sysctl -n can't glob, so no enforce
+  net.ipv4.conf.*.rp_filter:
+    value: '0'
+    enforce: false
 
 # frrouting
 exporters::frr_exporter::enable: true