diff --git a/modules/nginx.nix b/modules/nginx.nix
index ff4bde0..d77cc95 100644
--- a/modules/nginx.nix
+++ b/modules/nginx.nix
@@ -66,6 +66,8 @@ in
   };
 
   config = {
+    networking.firewall.allowedTCPPorts = [ 80 443 ];
+
     services.nginx.enable = true;
     services.nginx.logError = lib.mkIf cfg.debugLog "stderr warn";
     services.nginx.appendHttpConfig = lib.mkIf cfg.accessLog ''