diff --git a/modules/hosts/robin/configuration.nix b/modules/hosts/robin/configuration.nix
index 13928a3..08c3155 100644
--- a/modules/hosts/robin/configuration.nix
+++ b/modules/hosts/robin/configuration.nix
@@ -48,6 +48,11 @@
         /export/yarr 192.168.1.0/16(rw,secure,anonuid=1000,anongid=1000,all_squash)
         /export 192.168.1.0/16(ro,fsid=0,root_squash,subtree_check,secure)
       '';
+
+      # Pin the ports
+      server.statdPort = 4000;
+      server.lockdPort = 4001;
+      server.mountdPort = 4002;
     };
 
     fileSystems."/export/yarr" = {
@@ -56,6 +61,28 @@
       options = [ "bind" ];
     };
 
+    networking.firewall = {
+      enable = true;
+      
+      allowedTCPPorts = [ 
+	22 # SSH (CRITICAL: Do not remove)
+
+        # --- NFS Ports ---
+        111 2049 4000 4001 4002 
+        
+        # --- K3s Agent Ports ---
+        10250  # Kubelet API (Required for master node logs/metrics/exec)
+      ];
+      
+      allowedUDPPorts = [ 
+        # --- NFS Ports ---
+        111 2049 4000 4001 4002 
+        
+        # --- K3s Agent Ports ---
+        8472   # Flannel VXLAN overlay networking (Required for pod-to-pod communication)
+      ];
+    };
+
     boot = {
       loader = {
         systemd-boot.enable = true;