diff --git a/lib/fudo/adguard-dns-proxy.nix b/lib/fudo/adguard-dns-proxy.nix
index cb88c0a..5f118c5 100644
--- a/lib/fudo/adguard-dns-proxy.nix
+++ b/lib/fudo/adguard-dns-proxy.nix
@@ -258,6 +258,11 @@ in {
       };
     };
 
+    networking.firewall = {
+      allowedTCPPorts = [ cfg.dns.listen-port ];
+      allowedUDPPorts = [ cfg.dns.listen-port ];
+    };
+
     systemd.services.adguard-dns-proxy =
       let configFile = "/run/adguard-dns-proxy/config.yaml";
       in {