diff --git a/modules/bacula.nix b/modules/bacula.nix
index 3166da7..8244eb7 100644
--- a/modules/bacula.nix
+++ b/modules/bacula.nix
@@ -5,6 +5,8 @@
     "bacula/keypair".owner = "bacula";
     "bacula/masterkey".owner = "bacula";
   };
+  networking.firewall.allowedTCPPorts = [ config.services.bacula-fd.port ];
+  networking.firewall.allowedUDPPorts = [ config.services.bacula-fd.port ];
   services.bacula-fd = {
     enable = true;
     name = "ifsr-quitte";