diff --git a/service-configs.nix b/service-configs.nix
index d53ed7c..883c84e 100644
--- a/service-configs.nix
+++ b/service-configs.nix
@@ -9,27 +9,29 @@ rec {
   cpu_arch = "znver3";
 
   ports = {
+    # public
     http = 80;
     https = 443;
+    minecraft = 25565;
+    syncthing_protocol = 22000;
+    syncthing_discovery = 21027;
+    matrix_federation = 8448;
+    coturn = 3478;
+    coturn_tls = 5349;
+    livekit = 7880;
+    soulseek_listen = 50300;
+
+    # private
     jellyfin = 8096; # no services.jellyfin option for this
     torrent = 6011;
     bitmagnet = 3333;
     gitea = 2283;
     immich = 2284;
     soulseek_web = 5030;
-    soulseek_listen = 50300;
-    llama_cpp = 8991;
     vaultwarden = 8222;
     syncthing_gui = 8384;
-    syncthing_protocol = 22000;
-    syncthing_discovery = 21027;
-    minecraft = 25565;
     matrix = 6167;
-    matrix_federation = 8448;
-    coturn = 3478;
-    coturn_tls = 5349;
     ntfy = 2586;
-    livekit = 7880;
     lk_jwt = 8081;
     prowlarr = 9696;
     sonarr = 8989;
diff --git a/services/soulseek.nix b/services/soulseek.nix
index f2aa999..f9ad21b 100644
--- a/services/soulseek.nix
+++ b/services/soulseek.nix
@@ -75,4 +75,8 @@ in
   services.caddy.virtualHosts."soulseek.${service_configs.https.domain}".extraConfig = ''
     reverse_proxy :${builtins.toString config.services.slskd.settings.web.port}
   '';
+
+  networking.firewall.allowedTCPPorts = [
+    service_configs.ports.soulseek_listen
+  ];
 }