diff --git a/workstation/default.nix b/workstation/default.nix
index e919dda..79ccda3 100644
--- a/workstation/default.nix
+++ b/workstation/default.nix
@@ -229,6 +229,11 @@ in
     # allow you to SSH in over the public internet
     allowedTCPPorts = [ 22 ];
     #allowedTCPPortRanges = [ { from = 1714 ; to = 1764; } ];
+    interfaces = {
+      "tailscale0" = {
+        allowedTCPPorts = [ 22 8080 8443 ];
+      };
+    };
   };