diff --git a/services/openssh.nix b/services/openssh.nix
index 0bfd019..e239786 100644
--- a/services/openssh.nix
+++ b/services/openssh.nix
@@ -4,6 +4,8 @@
   services = {
     openssh = {
       enable = true;
+      openFirewall = true;
+      startWhenNeeded = false;
       settings = {
         PermitEmptyPasswords = "no";
         PermitRootLogin = "prohibit-password";