diff --git a/modules/syncthing.nix b/modules/syncthing.nix
index b5863cd..f8d6e4b 100644
--- a/modules/syncthing.nix
+++ b/modules/syncthing.nix
@@ -13,6 +13,10 @@ in
     sops.secrets."syncthing/key" = { };
     sops.secrets."syncthing/cert" = { };
 
+    networking.firewall.allowedTCPPorts = [
+      8384 # web gui port
+    ];
+
     services.syncthing =
       let dataDir = config.services.syncthing.dataDir;
       in {