diff --git a/nixarr/bazarr/default.nix b/nixarr/bazarr/default.nix
index 128a78b..2d05076 100644
--- a/nixarr/bazarr/default.nix
+++ b/nixarr/bazarr/default.nix
@@ -22,6 +22,14 @@ in {
       description = "The state directory for bazarr";
     };
 
+    openFirewall = mkOption {
+      type = types.bool;
+      defaultText = literalExpression ''"''${nixarr.vpn.enable}"'';
+      default = !cfg.vpn.enable;
+      example = true;
+      description = "Open firewall for Bazarr";
+    };
+
     vpn.enable = mkOption {
       type = types.bool;
       default = false;
@@ -49,6 +57,7 @@ in {
       enable = cfg.enable;
       user = "bazarr";
       group = "media";
+      openFirewall = cfg.openFirewall;
       dataDir = cfg.stateDir;
     };
 
diff --git a/nixarr/jellyfin/default.nix b/nixarr/jellyfin/default.nix
index 0da0c93..a05e2a2 100644
--- a/nixarr/jellyfin/default.nix
+++ b/nixarr/jellyfin/default.nix
@@ -19,6 +19,14 @@ in with lib; {
       description = "The state directory for Jellyfin.";
     };
 
+    openFirewall = mkOption {
+      type = types.bool;
+      defaultText = literalExpression ''"''${nixarr.vpn.enable}"'';
+      default = !cfg.vpn.enable;
+      example = true;
+      description = "Open firewall for Jellyfin";
+    };
+
     vpn.enable = mkOption {
       type = types.bool;
       default = false;
@@ -168,6 +176,7 @@ in with lib; {
         enable = cfg.enable;
         user = "streamer";
         group = "streamer";
+        openFirewall = cfg.openFirewall;
         logDir = "${cfg.stateDir}/log";
         cacheDir = "${cfg.stateDir}/cache";
         dataDir = "${cfg.stateDir}/data";
diff --git a/nixarr/lidarr/default.nix b/nixarr/lidarr/default.nix
index caa768e..43fe524 100644
--- a/nixarr/lidarr/default.nix
+++ b/nixarr/lidarr/default.nix
@@ -19,6 +19,14 @@ in {
       description = "The state directory for Lidarr";
     };
 
+    openFirewall = mkOption {
+      type = types.bool;
+      defaultText = literalExpression ''"''${nixarr.vpn.enable}"'';
+      default = !cfg.vpn.enable;
+      example = true;
+      description = "Open firewall for Lidarr";
+    };
+
     vpn.enable = mkOption {
       type = types.bool;
       default = false;
@@ -50,6 +58,7 @@ in {
       enable = cfg.enable;
       user = "lidarr";
       group = "media";
+      openFirewall = cfg.openFirewall;
       dataDir = cfg.stateDir;
     };
 
diff --git a/nixarr/prowlarr/default.nix b/nixarr/prowlarr/default.nix
index 6d2ac0e..6a502a1 100644
--- a/nixarr/prowlarr/default.nix
+++ b/nixarr/prowlarr/default.nix
@@ -24,6 +24,14 @@ in {
       description = "The state directory for Prowlarr.";
     };
 
+    openFirewall = mkOption {
+      type = types.bool;
+      defaultText = literalExpression ''"''${nixarr.vpn.enable}"'';
+      default = !cfg.vpn.enable;
+      example = true;
+      description = "Open firewall for Prowlarr";
+    };
+
     vpn.enable = mkOption {
       type = types.bool;
       default = false;
@@ -53,6 +61,7 @@ in {
 
     util-nixarr.services.prowlarr = {
       enable = true;
+      openFirewall = cfg.openFirewall;
       dataDir = cfg.stateDir;
     };
 
diff --git a/nixarr/radarr/default.nix b/nixarr/radarr/default.nix
index 3e6827e..3ba72a8 100644
--- a/nixarr/radarr/default.nix
+++ b/nixarr/radarr/default.nix
@@ -20,6 +20,14 @@ in {
       description = "The state directory for radarr.";
     };
 
+    openFirewall = mkOption {
+      type = types.bool;
+      defaultText = literalExpression ''"''${nixarr.vpn.enable}"'';
+      default = !cfg.vpn.enable;
+      example = true;
+      description = "Open firewall for Radarr";
+    };
+
     vpn.enable = mkOption {
       type = types.bool;
       default = false;
@@ -51,6 +59,7 @@ in {
       enable = cfg.enable;
       user = "radarr";
       group = "media";
+      openFirewall = cfg.openFirewall;
       dataDir = cfg.stateDir;
     };
 
diff --git a/nixarr/readarr/default.nix b/nixarr/readarr/default.nix
index e5258fe..3c99593 100644
--- a/nixarr/readarr/default.nix
+++ b/nixarr/readarr/default.nix
@@ -18,6 +18,14 @@ in {
       description = "The state directory for Readarr";
     };
 
+    openFirewall = mkOption {
+      type = types.bool;
+      defaultText = literalExpression ''"''${nixarr.vpn.enable}"'';
+      default = !cfg.vpn.enable;
+      example = true;
+      description = "Open firewall for Readarr";
+    };
+
     vpn.enable = mkOption {
       type = types.bool;
       default = false;
@@ -49,6 +57,7 @@ in {
       enable = cfg.enable;
       user = "readarr";
       group = "media";
+      openFirewall = cfg.openFirewall;
       dataDir = cfg.stateDir;
     };
 
diff --git a/nixarr/sonarr/default.nix b/nixarr/sonarr/default.nix
index 73cc144..eb329ae 100644
--- a/nixarr/sonarr/default.nix
+++ b/nixarr/sonarr/default.nix
@@ -24,6 +24,14 @@ in {
       description = "The state directory for Sonarr.";
     };
 
+    openFirewall = mkOption {
+      type = types.bool;
+      defaultText = literalExpression ''"''${nixarr.vpn.enable}"'';
+      default = !cfg.vpn.enable;
+      example = true;
+      description = "Open firewall for Sonarr";
+    };
+
     vpn.enable = mkOption {
       type = types.bool;
       default = false;
@@ -55,6 +63,7 @@ in {
       enable = cfg.enable;
       user = "sonarr";
       group = "media";
+      openFirewall = cfg.openFirewall;
       dataDir = cfg.stateDir;
     };
 
diff --git a/nixarr/transmission/default.nix b/nixarr/transmission/default.nix
index 46bc728..9b52505 100644
--- a/nixarr/transmission/default.nix
+++ b/nixarr/transmission/default.nix
@@ -74,6 +74,14 @@ in {
       '';
     };
 
+    openFirewall = mkOption {
+      type = types.bool;
+      defaultText = literalExpression ''"''${nixarr.vpn.enable}"'';
+      default = !cfg.vpn.enable;
+      example = true;
+      description = "Open firewall for `peer-port` and `rpc-port`.";
+    };
+
     vpn.enable = mkOption {
       type = types.bool;
       default = false;
@@ -270,8 +278,8 @@ in {
         then pkgs.flood-for-transmission
         else null;
       package = pkgs.transmission_4;
-      openRPCPort = false;
-      openPeerPorts = !cfg.vpn.enable;
+      openRPCPort = cfg.openFirewall;
+      openPeerPorts = cfg.openFirewall;
       settings =
         {
           download-dir = downloadDir;