diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc
index 640e2c4539..ae33a5ed10 100644
--- a/etc/inc/filter.inc
+++ b/etc/inc/filter.inc
@@ -2328,6 +2328,11 @@ function filter_rules_generate() {
 block in $log all label "Default deny rule"
 block out $log all label "Default deny rule"
 
+#--------------------------------------------------------------------------
+# default LAN pass rule
+#--------------------------------------------------------------------------
+pass in on \$lan from $lan:network to any keep state
+
 # We use the mighty pf, we cannot be fooled.
 block quick proto { tcp, udp } from any port = 0 to any
 block quick proto { tcp, udp } from any to any port = 0