diff --git a/hosts/hecuba/default.nix b/hosts/hecuba/default.nix
index 69a31eb..30924f3 100644
--- a/hosts/hecuba/default.nix
+++ b/hosts/hecuba/default.nix
@@ -44,6 +44,10 @@
 
   security.sudo.wheelNeedsPassword = false;
 
+  networking = {
+    firewall.enable = true;
+  };
+
   services.openssh = {
     enable = true;
     harden = true;