diff --git a/hosts/fw.cloonar.com/modules/firewall.nix b/hosts/fw.cloonar.com/modules/firewall.nix
index 26aa5a1..8ba563f 100644
--- a/hosts/fw.cloonar.com/modules/firewall.nix
+++ b/hosts/fw.cloonar.com/modules/firewall.nix
@@ -64,7 +64,8 @@
             iifname "multimedia" oifname { "lan" } counter accept
 
             # lan and vpn to any
-            iifname { "lan", "wg_cloonar" } oifname { "server", "multimedia", "smart", "wrwks", "wg_epicenter", "wg_ghetto_at" } counter accept
+            # TODO: disable wan when finished
+            iifname { "wan", "lan", "wg_cloonar" } oifname { "server", "multimedia", "smart", "wrwks", "wg_epicenter", "wg_ghetto_at" } counter accept
 
             # Allow trusted network WAN access
             iifname {