diff --git a/modules/nixos/services/nameservers/public.nix b/modules/nixos/services/nameservers/public.nix
index 0841d75..2718038 100644
--- a/modules/nixos/services/nameservers/public.nix
+++ b/modules/nixos/services/nameservers/public.nix
@@ -73,6 +73,11 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    networking.firewall = {
+      allowedTCPPorts = [ 53 ];
+      allowedUDPPorts = [ 53 ];
+    };
+
     services.nsd = {
       enable = true;
       interfaces = [ netCfg.underlay.interface ];