{ ... }: {
  networking = {
    firewall = {
      enable = true;
      allowedTCPPorts = [
        53    # DNS
        80    # HTTP
        443   # HTTPS
        5696  # DSM-KMIP
        5697  # DSM-KMIP Backup
      ];
      interfaces = {
        tailscale0= { 
          allowedTCPPorts = [
            53   # DNS
            80    # HTTP
            443   # HTTPS
          ];
        };
      };
    };
  };
}