{
  networking.firewall = {
    enable = true;
    allowedTCPPorts = [
      22 # SSH
      53 # DNS (AdGuard)
      80 # HTTP
      443 # HTTPS
      784 # DNS-over-QUIC
      853 # DNS-over-TLS
      3001 # Uptime Kuma
      3015
      4438
      5443
      8088
      10171 # v2raya SOCKS5 LAN
      10172 # v2raya HTTP proxy LAN
      10380
    ];
    allowedUDPPorts = [
      53 # DNS
      443 # QUIC
      784 # DNS-over-QUIC
      9993 # ZeroTier
      5443
    ];
  };
}