diff --git a/configs/common.nix b/configs/common.nix
index d1c5d67..8bdb077 100644
--- a/configs/common.nix
+++ b/configs/common.nix
@@ -133,7 +133,7 @@ in {
     tailscale = {
       enable = true;
       useRoutingFeatures = "both";
-      extraUpFlags = ["--ssh"];
+      extraUpFlags = ["--ssh" "--stateful-filtering"];
       authKeyFile = config.age.secrets.tailscaleKey.path;
     };
   };