diff --git a/openbsc/src/nat/bsc_nat.c b/openbsc/src/nat/bsc_nat.c
index 7c9f6c7..4a0a15b 100644
--- a/openbsc/src/nat/bsc_nat.c
+++ b/openbsc/src/nat/bsc_nat.c
@@ -561,6 +561,7 @@
 
 static int forward_sccp_to_msc(struct bsc_connection *bsc, struct msgb *msg)
 {
+	struct msgb *refuse;
 	struct sccp_connections *con;
 	struct bsc_nat_parsed *parsed;
 
@@ -591,6 +592,8 @@
 	if (parsed->ipa_proto == IPAC_PROTO_SCCP) {
 		switch (parsed->sccp_type) {
 		case SCCP_MSG_TYPE_CR:
+			if (bsc_nat_filter_sccp_cr(bsc, msg, parsed) != 0)
+				goto exit3;
 			if (create_sccp_src_ref(bsc, msg, parsed) != 0)
 				goto exit2;
 			con = patch_sccp_src_ref_to_msc(msg, parsed, bsc);
@@ -654,6 +657,13 @@
 		goto exit2;
 	}
 
+exit3:
+	/* send a SCCP Connection Refused */
+	refuse = sccp_create_refuse(parsed->src_local_ref, SCCP_REFUSAL_SCCP_FAILURE);
+	if (refuse) {
+		bsc_send_data(bsc, refuse->l2h, msgb_l2len(refuse), IPAC_PROTO_SCCP);
+		msgb_free(refuse);
+	}
 exit2:
 	talloc_free(parsed);
 	msgb_free(msg);