diff --git a/common/tailscale.nix b/common/tailscale.nix
index 12922dd..b948a5f 100644
--- a/common/tailscale.nix
+++ b/common/tailscale.nix
@@ -10,5 +10,8 @@
     ];
     # Required to connect to Tailscale exit nodes
     checkReversePath = "loose";
+    interfaces.${config.services.tailscale.interfaceName} = {
+      allowedTCPPorts = [4000];
+    };
   };
 }