diff --git a/configurations/nixos/arma-reforger-tofu/default.nix b/configurations/nixos/arma-reforger-tofu/default.nix
index a11942e..4665437 100644
--- a/configurations/nixos/arma-reforger-tofu/default.nix
+++ b/configurations/nixos/arma-reforger-tofu/default.nix
@@ -18,7 +18,9 @@ in
   # systemd.tmpfiles.rules = [
   #   "d /var/lib/myapp 0755 myuser mygroup -"
   # ];
-
+  # read more options here
+  # https://search.nixos.org/options?channel=25.05&show=virtualisation.oci-containers.containers.%3Cname%3E.workdir&from=0&size=50&sort=relevance&type=packages&query=oci+containers
+  # https://wiki.nixos.org/wiki/NixOS_Containers
   services.yggdrasil.persistentKeys = false;
   virtualisation.podman.enable = true;
   virtualisation.oci-containers.containers = {
diff --git a/modules/nixos/common/firewall.nix b/modules/nixos/common/firewall.nix
new file mode 100644
index 0000000..6c93641
--- /dev/null
+++ b/modules/nixos/common/firewall.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+{
+  networking.nftables = {
+    enable = true;
+    ruleset = ''
+      table inet filter {
+        chain input {
+          type filter hook input priority filter; policy accept;
+          ct state related,established accept
+
+          # Restrict ygg0: only allow SSH in
+          iifname "ygg0" tcp dport 22 accept
+          iifname "ygg0" drop
+        }
+
+        chain forward {
+          type filter hook forward priority filter; policy accept;
+          # Optional: drop forwarding via ygg0
+          iifname "ygg0" drop
+        }
+
+        chain output {
+          type filter hook output priority filter; policy accept;
+        }
+      }
+    '';
+  };
+}