diff --git a/roles/firewall/tasks/main.yml b/roles/firewall/tasks/main.yml
index ceb7695..157b313 100644
--- a/roles/firewall/tasks/main.yml
+++ b/roles/firewall/tasks/main.yml
@@ -23,13 +23,20 @@
     - Restart dnsmasq
   tags: dnsmasq
 
-- name: Enable IP forwarding
-  ansible.posix.sysctl:
-    name: net.ipv4.ip_forward
-    value: '1'
-    sysctl_set: true
-    state: present
-    reload: true
+- name: Enable IP fwd
+  ansible.builtin.command:
+    cmd: echo 1 > /proc/sys/net/ipv4/ip_forward
+  changed_when: firewall_command_result.rc == 0
+  register: firewall_command_result
+
+- name: Enable IP fwd permanently
+  ansible.builtin.lineinfile:
+    path: /etc/sysctl.d/ip_forward.conf
+    line: net.ipv4.ip_forward=1
+    owner: root
+    group: root
+    mode: '0655'
+    create: true
 
 - name: Template nftables FW rules
   ansible.builtin.template:
diff --git a/roles/single_nic_firewall/tasks/main.yml b/roles/single_nic_firewall/tasks/main.yml
index 9373225..a676e21 100644
--- a/roles/single_nic_firewall/tasks/main.yml
+++ b/roles/single_nic_firewall/tasks/main.yml
@@ -46,13 +46,20 @@
     - Restart dnsmasq
   tags: dnsmasq
 
-- name: Enable IP forwarding
-  ansible.posix.sysctl:
-    name: net.ipv4.ip_forward
-    value: '1'
-    sysctl_set: true
-    state: present
-    reload: true
+- name: Enable IP fwd
+  ansible.builtin.command:
+    cmd: echo 1 > /proc/sys/net/ipv4/ip_forward
+  changed_when: single_nic_firewall_command_result.rc == 0
+  register: single_nic_firewall_command_result
+
+- name: Enable IP fwd permanently
+  ansible.builtin.lineinfile:
+    path: /etc/sysctl.d/ip_forward.conf
+    line: net.ipv4.ip_forward=1
+    owner: root
+    group: root
+    mode: '0655'
+    create: true
 
 - name: Template nftables FW rules
   ansible.builtin.template: