diff --git a/manifests/system.pp b/manifests/system.pp
index fa8bce621904e8b24c3546959e5ab7f76acb59ff..cf02efba580c28e29546afb82881bb8072aab7c3 100644
--- a/manifests/system.pp
+++ b/manifests/system.pp
@@ -41,6 +41,27 @@ class analysator::system::nat {
     }
   }
 
+  # CVE-2024-6387 ("regreSSHion")
+  # https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
+  firewall { '000 block ssh outside lysator (v4)':
+    chain => 'INPUT',
+    dport => '22',
+    source => '! 130.236.254.0/24',
+    proto => 'tcp',
+    action => 'reject',
+  }
+
+  # CVE-2024-6387 ("regreSSHion")
+  # https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
+  firewall { '000 block ssh outside lysator (v6)':
+    chain => 'INPUT',
+    dport => '22',
+    source => '! 2001:6b0:17:f0a0::/64',
+    proto => 'tcp',
+    action => 'reject',
+    provider => 'ip6tables',
+  }
+
   firewall { '200 forward internal':
     chain    => 'FORWARD',
     iniface  => $analysator::system::internal_iface,