diff --git a/systems/etna/default.nix b/systems/etna/default.nix
index ac77b9a..0db80bc 100644
--- a/systems/etna/default.nix
+++ b/systems/etna/default.nix
@@ -35,6 +35,8 @@ in {
   boot.loader.systemd-boot.enable = true;
 
   services = {
+    openssh.openFirewall = true;
+
     tailscale.extraUpFlags = ["--advertise-exit-node"];
 
     cloudflared = {