diff --git a/flake.lock b/flake.lock
index 1a27e68..af7482a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -104,11 +104,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1784796856,
-        "narHash": "sha256-wWFrV5/Qbm+lyt5x20E/bSbfJiGKMo4RCxZV8cl/WZI=",
+        "lastModified": 1785090369,
+        "narHash": "sha256-m0pDuRJG7EDo9ri+4Ksu83VsI+PlxNC9lNBfydejce4=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "e2587caef70cea85dd97d7daab492899902dbf5d",
+        "rev": "624af665418d3c65d544145b4d34ad696439570e",
         "type": "github"
       },
       "original": {
@@ -193,11 +193,11 @@
     },
     "vpn-confinement": {
       "locked": {
-        "lastModified": 1784582736,
-        "narHash": "sha256-a3V/LkUvwbN30QlCwPjNQq88TGOXiqXAzcYTSWgYIp4=",
+        "lastModified": 1785142579,
+        "narHash": "sha256-WEPxDMiKt3uGVVu/aorHnIgYYW62mEq2Q+rlN3qH6bg=",
         "owner": "Maroka-chan",
         "repo": "VPN-Confinement",
-        "rev": "bd17046da0262f3a93524845982825fa2ed23f40",
+        "rev": "b3aa71a7edfe6af748c23729d1bdec3b499741ff",
         "type": "github"
       },
       "original": {
diff --git a/modules/services/gitea.nix b/modules/services/gitea.nix
index cabc9fc..ee93b25 100644
--- a/modules/services/gitea.nix
+++ b/modules/services/gitea.nix
@@ -46,4 +46,7 @@
       group = "gitea-runner";
     };
   };
+  networking.firewall = {
+      allowedTCPPorts = [3000];
+    };
 }
diff --git a/modules/system/networking.nix b/modules/system/networking.nix
index fd77188..995ca61 100644
--- a/modules/system/networking.nix
+++ b/modules/system/networking.nix
@@ -4,6 +4,7 @@
     nameservers = ["1.1.1.1" "1.0.0.1"];
     firewall = {
       enable = true;
+      trustedInterfaces = [ "podman0" ];
     };
     nftables = {
       enable = true;