diff --git a/mail-server.nix b/mail-server.nix
index 65d2b54..20e47c8 100644
--- a/mail-server.nix
+++ b/mail-server.nix
@@ -65,6 +65,12 @@ in
     enable = true;
   };
 
+  # firewall
+  networking.firewall = {
+    enable = true;
+    allowedTCPPorts = [ 25 143 587 ]; # < TODO: make this flexible
+  };
+
   imports = [ 
     ./mail-server/dovecot.nix  # dovecot
     ./mail-server/postfix.nix  # postfix