diff --git a/files/firewall b/files/firewall
index 3204ec5..76d3ae5 100755
--- a/files/firewall
+++ b/files/firewall
@@ -22,8 +22,9 @@ case $1 in
         iptables -A INPUT                                                   -p udp   --dport    500 --sport  500                     -j ACCEPT   # ipsec
         iptables -A INPUT                                                   -p udp   --dport   4500 --sport 4500                     -j ACCEPT   # ipsec
         iptables -A INPUT -s 170.199.217.0                                  -p tcp   --dport     22                                  -j ACCEPT   # ssh from bastion
-        iptables -A INPUT -s 10.1.19.1                                      -p tcp   --dport     22                                  -j ACCEPT   # ssh from bastion
         iptables -A INPUT -s 170.199.217.0                                  -p udp   --sport     53                                  -j ACCEPT   # dns replies from bastion
+        iptables -A INPUT -s 10.1.19.1                                      -p tcp   --dport     22                                  -j ACCEPT   # ssh from bastion
+        iptables -A INPUT -s 10.1.19.11                                     -p tcp   --dport     22                                  -j ACCEPT   # ssh from bastion2
         iptables -A INPUT -s 170.199.216.1                                  -p tcp   --sport   2379                                  -j ACCEPT   # etcd replies stackapi
         iptables -A INPUT -s 170.199.216.13                                 -p tcp   --sport    443                                  -j ACCEPT   # mirrors.wit.com
         iptables -A INPUT -s 170.199.216.13                                 -p tcp   --sport     25                                  -j ACCEPT   # allow email smart host
@@ -86,6 +87,8 @@ case $1 in
         ip6tables -A INPUT                               -p ipv6-icmp                                           -j ACCEPT   # ping
         ip6tables -A INPUT -s 2604:bbc0:0:113::1         -p tcp  --dport    22                                  -j ACCEPT   # ssh from bastion
         ip6tables -A INPUT -s 2604:bbc0:0:113::1         -p udp  --sport    53                                  -j ACCEPT   # dns replies from bastion
+        ip6tables -A INPUT -s 2604:bbc0:0:113::b         -p tcp  --dport    22                                  -j ACCEPT   # ssh from bastion2
+        ip6tables -A INPUT -s 2604:bbc0:0:113::b         -p udp  --sport    53                                  -j ACCEPT   # dns replies from bastion2
         ip6tables -A INPUT -s 2001:67c:1560:8003::c7     -p udp  --sport   123                                  -j ACCEPT   # ntp
         ip6tables -A INPUT -s 2001:67c:1560:8003::c8     -p udp  --sport   123                                  -j ACCEPT   # ntp
 	ip6tables -A INPUT -s fe80::/10        -i feth+  -p tcp  --sport   179                                  -j ACCEPT   # bgp (allow init as well as responding)