diff --git a/testing/tests/ikev2/net2net-dnscert/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/net2net-dnscert/hosts/moon/etc/iptables.rules
index b2c425289..7d1bea971 100644
--- a/testing/tests/ikev2/net2net-dnscert/hosts/moon/etc/iptables.rules
+++ b/testing/tests/ikev2/net2net-dnscert/hosts/moon/etc/iptables.rules
@@ -25,4 +25,8 @@
 -A INPUT  -i eth0 -p udp --sport 53 -s PH_IP_WINNETOU -j ACCEPT
 -A OUTPUT -o eth0 -p udp --dport 53 -d PH_IP_WINNETOU -j ACCEPT
 
+# allow DNSSEC fetch from winnetou via TCP
+-A INPUT  -i eth0 -p tcp --sport 53 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 53 -d PH_IP_WINNETOU -j ACCEPT
+
 COMMIT
diff --git a/testing/tests/ikev2/net2net-dnscert/hosts/sun/etc/iptables.rules b/testing/tests/ikev2/net2net-dnscert/hosts/sun/etc/iptables.rules
index b2c425289..7d1bea971 100644
--- a/testing/tests/ikev2/net2net-dnscert/hosts/sun/etc/iptables.rules
+++ b/testing/tests/ikev2/net2net-dnscert/hosts/sun/etc/iptables.rules
@@ -25,4 +25,8 @@
 -A INPUT  -i eth0 -p udp --sport 53 -s PH_IP_WINNETOU -j ACCEPT
 -A OUTPUT -o eth0 -p udp --dport 53 -d PH_IP_WINNETOU -j ACCEPT
 
+# allow DNSSEC fetch from winnetou via TCP
+-A INPUT  -i eth0 -p tcp --sport 53 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 53 -d PH_IP_WINNETOU -j ACCEPT
+
 COMMIT