diff --git a/deployment/metrics/qdr-container-puppet.yaml b/deployment/metrics/qdr-container-puppet.yaml
index a3bfe9617d..9c00d958fa 100644
--- a/deployment/metrics/qdr-container-puppet.yaml
+++ b/deployment/metrics/qdr-container-puppet.yaml
@@ -126,6 +126,10 @@ parameters:
     default: 'no'
     description: Authenticate the client using SSL/TLS
     type: string
+  MetricsQdrExternalEndpoint:
+    default: false
+    description: Whether QDR should listen on external network interface.
+    type: boolean
   InternalTLSCAFile:
     default: '/etc/ipa/ca.crt'
     type: string
@@ -160,12 +164,19 @@ outputs:
             - {get_param: MetricsQdrLoggingSource}
       config_settings:
         map_merge:
-          - tripleo::profile::base::metrics::qdr::listener_addr:
+          - tripleo::profile::base::metrics::qdr::external_listener_addr:
+              str_replace:
+                template:
+                  "%{hiera('$NETWORK')}"
+                params:
+                  $NETWORK: {get_param: [ServiceNetMap, PublicNetwork]}
+            tripleo::profile::base::metrics::qdr::listener_addr:
               str_replace:
                 template:
                   "%{hiera('$NETWORK')}"
                 params:
                   $NETWORK: {get_param: [ServiceNetMap, MetricsQdrNetwork]}
+            tripleo::profile::base::metrics::qdr::listen_on_external: {get_param: MetricsQdrExternalEndpoint}
             tripleo::profile::base::metrics::qdr::listener_port: {get_param: MetricsQdrPort}
             tripleo::profile::base::metrics::qdr::username: {get_param: MetricsQdrUsername}
             tripleo::profile::base::metrics::qdr::password: {get_param: MetricsQdrPassword}