diff --git a/sites/BCN01-LAB/firewall.auto.tfvars b/sites/BCN01-LAB/firewall.auto.tfvars
index 6789c72..6c49c55 100755
--- a/sites/BCN01-LAB/firewall.auto.tfvars
+++ b/sites/BCN01-LAB/firewall.auto.tfvars
@@ -22,6 +22,17 @@ firewall_rules = [
     dest_port      = "any"
     syslog_enabled = false
   },
+  {
+    # Permite que los clientes GUEST (VLAN GUEST) lleguen a internet
+    comment        = "Permitir GUEST a internet"
+    policy         = "allow"
+    protocol       = "any"
+    src_cidr       = "10.2.40.0/21"  # VLAN 101 - GUEST
+    src_port       = "any"
+    dest_cidr      = "any"
+    dest_port      = "any"
+    syslog_enabled = false
+  },
   {
     comment        = "Bloqueo temporal switch a 8.8.8.8"
     policy         = "deny"