diff --git a/modules/consul/auto_values.tf b/modules/consul/auto_values.tf
index b3ddebb8..be7b4e15 100644
--- a/modules/consul/auto_values.tf
+++ b/modules/consul/auto_values.tf
@@ -6,7 +6,7 @@
 variable "auto_ingress_rules" {
   description = "List of ingress rules to add automatically"
   type        = "list"
-  default     = ["consul-tcp", "consul-webui-tcp", "consul-dns-tcp", "consul-dns-udp", "consul-serf-lan-tcp", "consul-serf-lan-udp", "consul-serf-wan-tcp", "consul-serf-wan-udp"]
+  default     = ["consul-tcp", "consul-cli-rpc-tcp", "consul-webui-tcp", "consul-dns-tcp", "consul-dns-udp", "consul-serf-lan-tcp", "consul-serf-lan-udp", "consul-serf-wan-tcp", "consul-serf-wan-udp"]
 }
 
 variable "auto_ingress_with_self" {
diff --git a/rules.tf b/rules.tf
index 04e9dc4c..795198ed 100644
--- a/rules.tf
+++ b/rules.tf
@@ -20,6 +20,7 @@ variable "rules" {
 
     # Consul
     consul-tcp          = [8300, 8300, "tcp", "Consul server"]
+    consul-cli-rpc-tcp  = [8400, 8400, "tcp", "Consul CLI RPC"]
     consul-webui-tcp    = [8500, 8500, "tcp", "Consul web UI"]
     consul-dns-tcp      = [8600, 8600, "tcp", "Consul DNS"]
     consul-dns-udp      = [8600, 8600, "udp", "Consul DNS"]
@@ -175,7 +176,7 @@ variable "auto_groups" {
     }
 
     consul = {
-      ingress_rules     = ["consul-tcp", "consul-webui-tcp", "consul-dns-tcp", "consul-dns-udp", "consul-serf-lan-tcp", "consul-serf-lan-udp", "consul-serf-wan-tcp", "consul-serf-wan-udp"]
+      ingress_rules     = ["consul-tcp", "consul-cli-rpc-tcp", "consul-webui-tcp", "consul-dns-tcp", "consul-dns-udp", "consul-serf-lan-tcp", "consul-serf-lan-udp", "consul-serf-wan-tcp", "consul-serf-wan-udp"]
       ingress_with_self = ["all-all"]
       egress_rules      = ["all-all"]
     }