diff --git a/modules/services/nas/nginx.nix b/modules/services/nas/nginx.nix
index 22dd4fe..2b1fec2 100644
--- a/modules/services/nas/nginx.nix
+++ b/modules/services/nas/nginx.nix
@@ -39,6 +39,12 @@
     };
   };
 
+  networking.firewall = {
+    enable = true;
+    allowedUDPPorts = [  ];
+    allowedTCPPorts = [ 80 443 ];
+  };
+
   age.secrets."services/acme/opel-online" = {
     file = ../../../secrets/services/acme/opel-online.age;
     owner = "acme";