diff --git a/modules/nixos/think-backend-gtcm.nix b/modules/nixos/think-backend-gtcm.nix
index 79a69a3..71072d9 100644
--- a/modules/nixos/think-backend-gtcm.nix
+++ b/modules/nixos/think-backend-gtcm.nix
@@ -239,6 +239,11 @@ in
       "d ${cfg.dataDir}/storage/uploads            0700 ${cfg.user} ${cfg.group} - -"
     ];
 
+    networking.firewall.allowedTCPPorts = [
+      80
+      443
+    ];
+
     services.nginx = {
       enable = true;
       recommendedTlsSettings = true;
diff --git a/modules/nixos/think-gtcm.nix b/modules/nixos/think-gtcm.nix
index a84d256..0aa7fd1 100644
--- a/modules/nixos/think-gtcm.nix
+++ b/modules/nixos/think-gtcm.nix
@@ -248,6 +248,11 @@ in
       "d ${cfg.dataDir}/storage/uploads            0700 ${cfg.user} ${cfg.group} - -"
     ];
 
+    networking.firewall.allowedTCPPorts = [
+      80
+      443
+    ];
+
     services.nginx = {
       enable = true;
       recommendedTlsSettings = true;