diff --git a/modules/nas/default.nix b/modules/nas/default.nix
index e418c03..cda73a6 100644
--- a/modules/nas/default.nix
+++ b/modules/nas/default.nix
@@ -13,4 +13,25 @@
     #
     # '';
   };
+
+  networking.firewall = {
+    enable = true;
+    # for NFSv3; view with `rpcinfo -p`
+    allowedTCPPorts = [
+      111
+      2049
+      4000
+      4001
+      4002
+      20048
+    ];
+    allowedUDPPorts = [
+      111
+      2049
+      4000
+      4001
+      4002
+      20048
+    ];
+  };
 }