diff --git a/krebs/1systems/puyak/net.nix b/krebs/1systems/puyak/net.nix
index 8dab11e16..c535e51aa 100644
--- a/krebs/1systems/puyak/net.nix
+++ b/krebs/1systems/puyak/net.nix
@@ -8,7 +8,7 @@ in {
     SUBSYSTEM=="net", ATTR{address}=="3c:97:0e:07:b9:14", NAME="${ext-if}"
   '';
   networking = {
-    firewall.enable = false;
+    firewall.enable = true;
     firewall.allowedTCPPorts = [ 8088 8086 8083 5901 ];
     interfaces."${ext-if}".ipv4.addresses = [
       {