diff --git a/site-cookbooks/kosmos-bitcoin/attributes/default.rb b/site-cookbooks/kosmos-bitcoin/attributes/default.rb
index dc11a70..b595fb7 100644
--- a/site-cookbooks/kosmos-bitcoin/attributes/default.rb
+++ b/site-cookbooks/kosmos-bitcoin/attributes/default.rb
@@ -42,7 +42,7 @@ node.default['lnd']['alias'] = 'ln2.kosmos.org'
 node.default['lnd']['color'] = '#5e0c99'
 node.default['lnd']['log_level'] = 'info'
 node.default['lnd']['public_ip'] = '148.251.237.111'
-node.default['lnd']['public_port'] = '9375'
+node.default['lnd']['public_port'] = '9735'
 node.default['lnd']['port'] = '9736'
 node.default['lnd']['minchansize'] = '1000000'
 node.default['lnd']['basefee'] = '500'
diff --git a/site-cookbooks/kosmos-bitcoin/recipes/c-lightning.rb b/site-cookbooks/kosmos-bitcoin/recipes/c-lightning.rb
index b86b184..b8f2865 100644
--- a/site-cookbooks/kosmos-bitcoin/recipes/c-lightning.rb
+++ b/site-cookbooks/kosmos-bitcoin/recipes/c-lightning.rb
@@ -92,3 +92,9 @@ systemd_unit 'lightningd.service' do
   triggers_reload true
   action [:create, :enable, :start]
 end
+
+firewall_rule 'lightningd' do
+  port     [9735] # TODO use attribute
+  protocol :tcp
+  command  :allow
+end
diff --git a/site-cookbooks/kosmos-bitcoin/recipes/lnd.rb b/site-cookbooks/kosmos-bitcoin/recipes/lnd.rb
index b179c42..4e2464a 100644
--- a/site-cookbooks/kosmos-bitcoin/recipes/lnd.rb
+++ b/site-cookbooks/kosmos-bitcoin/recipes/lnd.rb
@@ -89,3 +89,9 @@ systemd_unit 'lnd.service' do
   triggers_reload true
   action [:create, :enable, :start]
 end
+
+firewall_rule 'lnd' do
+  port     [node['lnd']['port']]
+  protocol :tcp
+  command  :allow
+end