diff --git a/systems/hetzner/default.nix b/systems/hetzner/default.nix
index 41909ee..2808d3a 100644
--- a/systems/hetzner/default.nix
+++ b/systems/hetzner/default.nix
@@ -30,6 +30,12 @@
     };
   };
 
+  networking.firewall = {
+    enable = true;
+    allowedTCPPorts = [ 21 ];
+    allowedUDPPorts = [ 21 ];
+  };
+
   systemd.network.networks."10-uplink".networkConfig.Address = "2a01:4f8:a0:31e5::/64";
 
   time.timeZone = "Europe/Berlin";