diff --git a/mastus/configuration.nix b/mastus/configuration.nix
index 2406767..cc7f1a0 100644
--- a/mastus/configuration.nix
+++ b/mastus/configuration.nix
@@ -39,4 +39,14 @@
 
   services.nginx.enable = true;
 
+  networking.firewall = {
+    allowedTCPPorts = [
+      # http
+      80 443
+
+      # mail
+      25 143
+    ];
+  };
+
 }