diff --git a/config/profiles/network.nix b/config/profiles/network.nix
index 43b56973..9c309195 100644
--- a/config/profiles/network.nix
+++ b/config/profiles/network.nix
@@ -14,6 +14,8 @@
       meta l4proto 89 iifname wgmesh-* accept
     '';
 
+    network.firewall.private.interfaces = singleton "wgmesh-*";
+
     networking.policyrouting = {
       enable = true;
       rules = [