diff --git a/wgengine/filter/filter.go b/wgengine/filter/filter.go
index d34af75ef..f1f195eeb 100644
--- a/wgengine/filter/filter.go
+++ b/wgengine/filter/filter.go
@@ -379,7 +379,7 @@ func (f *Filter) RunIn(q *packet.Parsed, rf RunFlags) Response {
 func (f *Filter) RunOut(q *packet.Parsed, rf RunFlags) Response {
 	dir := out
 	r := f.pre(q, rf, dir)
-	if r == Drop || r == Accept {
+	if r == Accept || r == Drop {
 		// already logged
 		return r
 	}