diff --git a/package/gluon-respondd/files/lib/gluon/upgrade/400-respondd-firewall b/package/gluon-respondd/files/lib/gluon/upgrade/400-respondd-firewall
index 65c5d8e34d0077f041400e831390a2eff456329a..c507683038dab0924874131137592f35e284d260 100755
--- a/package/gluon-respondd/files/lib/gluon/upgrade/400-respondd-firewall
+++ b/package/gluon-respondd/files/lib/gluon/upgrade/400-respondd-firewall
@@ -16,5 +16,17 @@ uci:section('firewall', 'rule', 'wan_respondd',
   }
 )
 
+-- Restrict respondd queries to link-local addresses to prevent amplification attacks from outside
+uci:section('firewall', 'rule', 'client_respondd',
+  {
+    name = 'client_respondd',
+    src = 'client',
+    src_ip = '!fe80::/64',
+    dest_port = '1001',
+    proto = 'udp',
+    target = 'REJECT',
+  }
+)
+
 uci:save('firewall')
 uci:commit('firewall')