diff --git a/deployment/metrics/qdr-container-puppet.yaml b/deployment/metrics/qdr-container-puppet.yaml
index a830ed0123..5432f93fbf 100644
--- a/deployment/metrics/qdr-container-puppet.yaml
+++ b/deployment/metrics/qdr-container-puppet.yaml
@@ -161,9 +161,19 @@ outputs:
       config_settings:
         map_merge:
           - tripleo::metrics_qdr::firewall_rules:
-            '109 metrics qdr':
-              dport:
-                - {get_param: MetricsQdrPort}
+              map_merge:
+              - '109 metrics qdr':
+                  dport:
+                    - {get_param: MetricsQdrPort}
+              - map_merge:
+                  repeat:
+                    for_each:
+                      <%net_cidr%>: {get_param: [ServiceData, net_cidr_map, ctlplane]}
+                    template:
+                      '109 accept internal metrics qdr ctlplane subnet <%net_cidr%>':
+                        dport:
+                          - 5667
+                          - 5668
           - tripleo::profile::base::metrics::qdr::external_listener_addr:
               str_replace:
                 template: