diff --git a/modules/nginx/default.nix b/modules/nginx/default.nix
index e331329..5ff07ac 100644
--- a/modules/nginx/default.nix
+++ b/modules/nginx/default.nix
@@ -13,6 +13,7 @@ in {
 
   config = mkIf cfg.enable {
 
+    networking.firewall.allowedTCPPorts = [ 80 443 ];
     security.acme.email = "${cfg.email}";
     security.acme.acceptTerms = true;
     users.groups.nginx = { name = "nginx"; };