diff --git a/examples/kubernetes/ccp/README.md b/examples/kubernetes/ccp/README.md
index f2828c42b..7f49140ba 100644
--- a/examples/kubernetes/ccp/README.md
+++ b/examples/kubernetes/ccp/README.md
@@ -13,6 +13,8 @@ echo $(kubectl --namespace=openstack get svc/horizon -o go-template='{{(index .s
 * NAT on your router/jump-box to any k8s minion public IP and nodePort to provide external access:
 ```bash
 iptables -t nat -I PREROUTING -p tcp --dport 8080 -j DNAT --to-destination 10.210.0.12:32643
+iptables -t nat -I POSTROUTING -d 10.210.0.12 ! -s 10.210.0.0/24 -j MASQUERADE
+iptables -I FORWARD -d 10.210.0.12 -j ACCEPT
 ```
 
 Where `10.210.0.12` is IP of one of your k8s minions and `32643` is nodePort of Horizon service.