diff --git a/cluster/services/wireguard/mesh.nix b/cluster/services/wireguard/mesh.nix
index fdfe3ca..b29ba4f 100644
--- a/cluster/services/wireguard/mesh.nix
+++ b/cluster/services/wireguard/mesh.nix
@@ -20,6 +20,7 @@ in
 
   networking = {
     firewall = {
+      trustedInterfaces = [ "wgmesh" ];
       allowedUDPPorts = [ link.port ];
     };