diff --git a/daemon/fw/forwarder.cpp b/daemon/fw/forwarder.cpp
index 5c529a8..8ab209a 100644
--- a/daemon/fw/forwarder.cpp
+++ b/daemon/fw/forwarder.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2014-2019,  Regents of the University of California,
+ * Copyright (c) 2014-2020,  Regents of the University of California,
  *                           Arizona Board of Regents,
  *                           Colorado State University,
  *                           University Pierre & Marie Curie, Sorbonne University,
@@ -92,6 +92,18 @@
   interest.setTag(make_shared<lp::IncomingFaceIdTag>(ingress.face.getId()));
   ++m_counters.nInInterests;
 
+  // drop if HopLimit zero, decrement otherwise (if present)
+  if (interest.getHopLimit()) {
+    if (*interest.getHopLimit() < 1) {
+      NFD_LOG_DEBUG("onIncomingInterest in=" << ingress << " interest=" << interest.getName()
+                    << " hop-limit=0");
+      ++const_cast<PacketCounter&>(ingress.face.getCounters().nInHopLimitZero);
+      return;
+    }
+
+    const_cast<Interest&>(interest).setHopLimit(*interest.getHopLimit() - 1);
+  }
+
   // /localhost scope control
   bool isViolatingLocalhost = ingress.face.getScope() == ndn::nfd::FACE_SCOPE_NON_LOCAL &&
                               scope_prefix::LOCALHOST.isPrefixOf(interest.getName());
@@ -230,6 +242,14 @@
 Forwarder::onOutgoingInterest(const shared_ptr<pit::Entry>& pitEntry,
                               const FaceEndpoint& egress, const Interest& interest)
 {
+  // drop if HopLimit == 0 but sending on non-local face
+  if (interest.getHopLimit() == 0 && egress.face.getScope() == ndn::nfd::FACE_SCOPE_NON_LOCAL) {
+    NFD_LOG_DEBUG("onOutgoingInterest out=" << egress << " interest=" << pitEntry->getName()
+                  << " non-local hop-limit=0");
+    ++const_cast<PacketCounter&>(egress.face.getCounters().nOutHopLimitZero);
+    return;
+  }
+
   NFD_LOG_DEBUG("onOutgoingInterest out=" << egress << " interest=" << pitEntry->getName());
 
   // insert out-record