diff --git a/pkg/model/openstackmodel/firewall.go b/pkg/model/openstackmodel/firewall.go
index 20263a657d..8a1a57cf03 100644
--- a/pkg/model/openstackmodel/firewall.go
+++ b/pkg/model/openstackmodel/firewall.go
@@ -436,7 +436,8 @@ func (b *FirewallModelBuilder) addCNIRules(c *fi.ModelBuilderContext, sgMap map[
 			Protocol:  s(protocol),
 			EtherType: s(string(rules.EtherType4)),
 		}
-		addDirectionalGroupRule(c, nodeSG, masterSG, protocolRule)
+		addDirectionalGroupRule(c, masterSG, nil, protocolRule)
+		addDirectionalGroupRule(c, nodeSG, nil, protocolRule)
 	}
 
 	return nil