I guess when you add an internal network, it's probably a good idea to add it to the anti-spoofing configuration. :P