diff --git a/roles/traefik.nix b/roles/traefik.nix
index 0f9de62..af58ef1 100644
--- a/roles/traefik.nix
+++ b/roles/traefik.nix
@@ -48,6 +48,11 @@
             ];
           };
 
+          networking.firewall.allowedTCPPorts = [
+            80
+            443
+          ];
+
           sops.secrets = {
             "traefik/acmeEmail" = {
               owner = "traefik";