diff --git a/services/router.nix b/services/router.nix
index 1c4e9c5..efbd05b 100644
--- a/services/router.nix
+++ b/services/router.nix
@@ -52,8 +52,12 @@ let
   # ponytail: MAC-based like blockRules, so it inherits the same weakness — a
   # device that randomises its MAC walks around it. Fine for an IP camera,
   # which won't; match on the DHCP-reserved IP too if that ever changes.
+  # `counter` so the rule is self-verifying: `nft list chain inet filter
+  # forward` shows how much the device has tried to send off-LAN. A climbing
+  # number means isolation is doing work; a flat zero means either a quiet
+  # device or a rule that stopped matching, and those are worth telling apart.
   isolateRules = lib.concatMapStringsSep "\n            "
-    (d: ''iifname "eth0" ether saddr ${d.mac} drop comment "${d.name} isolated (no routing)"'')
+    (d: ''iifname "eth0" ether saddr ${d.mac} counter drop comment "${d.name} isolated (no routing)"'')
     isolatedDevices;
 
   # Phase-1 transition list; empty now that eero is in bridge mode and