diff --git a/hosts/affogato/default.nix b/hosts/affogato/default.nix
index c485f6b..624e97c 100644
--- a/hosts/affogato/default.nix
+++ b/hosts/affogato/default.nix
@@ -35,6 +35,11 @@
       "cloud.finallycoffee.eu"
     ];
   };
+  networking.firewall = {
+    enable = true;
+    allowedTCPPorts = [ 8883 ];
+    allowedUDPPorts = [ 2021 ];
+  };
 
   # Set your time zone.
   time.timeZone = "Europe/Berlin";