diff --git a/xos/synchronizers/vcpe/steps/sync_vcpetenant_vtn.yaml b/xos/synchronizers/vcpe/steps/sync_vcpetenant_vtn.yaml
index 9fc3f2a..eed6b42 100644
--- a/xos/synchronizers/vcpe/steps/sync_vcpetenant_vtn.yaml
+++ b/xos/synchronizers/vcpe/steps/sync_vcpetenant_vtn.yaml
@@ -226,9 +226,10 @@
     - reload ufw
 
   - name: base ufw setup uses /etc/rc.local
-    copy: src=/opt/xos/synchronizers/vcpe/files/etc/rc.local dest=/var/container_volumes/{{ container_name }}/etc/ owner=root group=root
+    template: src=/opt/xos/synchronizers/vcpe/templates/rc.local.j2 dest=/var/container_volumes/{{ container_name }}/etc/rc.local owner=root group=root mode=0755
     notify:
     - copy in /etc/rc.local
+    - rerun /etc/rc.local
 
   - name: create directory for local programs
     file: path=/var/container_volumes/{{ container_name }}/usr/local/sbin state=directory
@@ -267,5 +268,8 @@
   - name: copy in /etc/rc.local
     shell: docker cp /var/container_volumes/{{ container_name }}/etc/rc.local {{ container_name }}:/etc/
 
+  - name: rerun /etc/rc.local
+    shell: docker exec {{ container_name }} bash -c "/etc/rc.local"
+
   - name: reset bwlimits
     shell: docker exec {{ container_name }} bash -c "/usr/local/sbin/bwlimit.sh restart"
diff --git a/xos/synchronizers/vcpe/templates/bwlimit.sh.j2 b/xos/synchronizers/vcpe/templates/bwlimit.sh.j2
index 2e3852c..b267ada 100644
--- a/xos/synchronizers/vcpe/templates/bwlimit.sh.j2
+++ b/xos/synchronizers/vcpe/templates/bwlimit.sh.j2
@@ -22,8 +22,8 @@
 DNLD={{ downlink_speed }}          # DOWNLOAD Limit
 UPLD={{ uplink_speed }}            # UPLOAD Limit
 
-[ "$DNLD" == "None"] && DNLD=$MAXRATE
-[ "$UPLD" == "None"] && UPLD=$MAXRATE
+[ "$DNLD" == "None" ] && DNLD=$MAXRATE
+[ "$UPLD" == "None" ] && UPLD=$MAXRATE
 
 start() {
 
diff --git a/xos/synchronizers/vcpe/templates/rc.local.j2 b/xos/synchronizers/vcpe/templates/rc.local.j2
new file mode 100755
index 0000000..4226a48
--- /dev/null
+++ b/xos/synchronizers/vcpe/templates/rc.local.j2
@@ -0,0 +1,28 @@
+#!/bin/sh -e
+#
+# rc.local
+#
+# This script is executed at the end of each multiuser runlevel.
+# Make sure that the script will "exit 0" on success or any other
+# value on error.
+#
+# In order to enable or disable this script just change the execution
+# bits.
+#
+# By default this script does nothing.
+
+ufw enable
+ufw allow bootps
+ufw allow from 192.168.0.0/24
+{% if status == "enabled" %}
+ufw route allow in on eth1 out on eth0
+ufw route allow in on eth1 out on eth2
+{% else %}
+ufw route deny in on eth1 out on eth0
+ufw route deny in on eth1 out on eth2
+{% endif %}
+
+BWLIMIT=/usr/local/sbin/bwlimit.sh
+[ -e $BWLIMIT ] && $BWLIMIT restart || true
+
+exit 0
diff --git a/xos/synchronizers/vcpe/templates/start-vcpe-vtn.sh.j2 b/xos/synchronizers/vcpe/templates/start-vcpe-vtn.sh.j2
index ba862d9..e118b3c 100644
--- a/xos/synchronizers/vcpe/templates/start-vcpe-vtn.sh.j2
+++ b/xos/synchronizers/vcpe/templates/start-vcpe-vtn.sh.j2
@@ -16,7 +16,11 @@
 if [ "$?" == 1 ]
 then
     docker pull andybavier/docker-vcpe
-    docker run -d --name=$VCPE --privileged=true --net=none -v /var/container_volumes/$VCPE/etc/dnsmasq.d:/etc/dnsmasq.d:ro -v /var/container_volumes/$VCPE/usr/local/sbin:/usr/local/sbin:ro andybavier/docker-vcpe
+    docker run -d --name=$VCPE --privileged=true --net=none \
+    -v /var/container_volumes/$VCPE/etc/dnsmasq.d:/etc/dnsmasq.d:ro \
+    -v /var/container_volumes/$VCPE/usr/local/sbin:/usr/local/sbin:ro \
+    -v /var/container_volumes/$VCPE/etc/ufw:/etc/ufw \
+    andybavier/docker-vcpe
 else
     docker start $VCPE
 fi