diff --git a/nixarr/bazarr/default.nix b/nixarr/bazarr/default.nix
index 128a78b..a6669b6 100644
--- a/nixarr/bazarr/default.nix
+++ b/nixarr/bazarr/default.nix
@@ -22,6 +22,14 @@ in {
       description = "The state directory for bazarr";
     };
 
+    openFirewall = mkOption {
+      type = types.bool;
+      defaultText = literalExpression ''!cfg.vpn.enable'';
+      default = !cfg.vpn.enable;
+      example = true;
+      description = "Open firewall for Bazarr";
+    };
+
     vpn.enable = mkOption {
       type = types.bool;
       default = false;
@@ -49,6 +57,7 @@ in {
       enable = cfg.enable;
       user = "bazarr";
       group = "media";
+      openFirewall = cfg.openFirewall;
       dataDir = cfg.stateDir;
     };
 
diff --git a/nixarr/jellyfin/default.nix b/nixarr/jellyfin/default.nix
index 0da0c93..bc84bbb 100644
--- a/nixarr/jellyfin/default.nix
+++ b/nixarr/jellyfin/default.nix
@@ -14,11 +14,19 @@ in with lib; {
     stateDir = mkOption {
       type = types.path;
       default = "${nixarr.stateDir}/jellyfin";
-      defaultText = literalExpression ''"''${nixarr.stateDir}/jellyfin"'';
+      defaultText = literalExpression ''!cfg.vpn.enable'';
       example = "/home/user/.local/share/nixarr/jellyfin";
       description = "The state directory for Jellyfin.";
     };
 
+    openFirewall = mkOption {
+      type = types.bool;
+      defaultText = literalExpression ''"''${nixarr.vpn.enable}"'';
+      default = !cfg.vpn.enable;
+      example = true;
+      description = "Open firewall for Jellyfin";
+    };
+
     vpn.enable = mkOption {
       type = types.bool;
       default = false;
@@ -168,6 +176,7 @@ in with lib; {
         enable = cfg.enable;
         user = "streamer";
         group = "streamer";
+        openFirewall = cfg.openFirewall;
         logDir = "${cfg.stateDir}/log";
         cacheDir = "${cfg.stateDir}/cache";
         dataDir = "${cfg.stateDir}/data";
diff --git a/nixarr/lidarr/default.nix b/nixarr/lidarr/default.nix
index caa768e..d8ad080 100644
--- a/nixarr/lidarr/default.nix
+++ b/nixarr/lidarr/default.nix
@@ -14,11 +14,19 @@ in {
     stateDir = mkOption {
       type = types.path;
       default = "${nixarr.stateDir}/lidarr";
-      defaultText = literalExpression ''"''${nixarr.stateDir}/lidarr"'';
+      defaultText = literalExpression ''!cfg.vpn.enable'';
       example = "/home/user/.local/share/nixarr/lidarr";
       description = "The state directory for Lidarr";
     };
 
+    openFirewall = mkOption {
+      type = types.bool;
+      defaultText = literalExpression ''"''${nixarr.vpn.enable}"'';
+      default = !cfg.vpn.enable;
+      example = true;
+      description = "Open firewall for Lidarr";
+    };
+
     vpn.enable = mkOption {
       type = types.bool;
       default = false;
@@ -50,6 +58,7 @@ in {
       enable = cfg.enable;
       user = "lidarr";
       group = "media";
+      openFirewall = cfg.openFirewall;
       dataDir = cfg.stateDir;
     };
 
diff --git a/nixarr/prowlarr/default.nix b/nixarr/prowlarr/default.nix
index 6d2ac0e..bdcd569 100644
--- a/nixarr/prowlarr/default.nix
+++ b/nixarr/prowlarr/default.nix
@@ -19,11 +19,19 @@ in {
     stateDir = mkOption {
       type = types.path;
       default = "${nixarr.stateDir}/prowlarr";
-      defaultText = literalExpression ''"''${nixarr.stateDir}/prowlarr"'';
+      defaultText = literalExpression ''!cfg.vpn.enable'';
       example = "/home/user/.local/share/nixarr/prowlarr";
       description = "The state directory for Prowlarr.";
     };
 
+    openFirewall = mkOption {
+      type = types.bool;
+      defaultText = literalExpression ''"''${nixarr.vpn.enable}"'';
+      default = !cfg.vpn.enable;
+      example = true;
+      description = "Open firewall for Prowlarr";
+    };
+
     vpn.enable = mkOption {
       type = types.bool;
       default = false;
@@ -53,6 +61,7 @@ in {
 
     util-nixarr.services.prowlarr = {
       enable = true;
+      openFirewall = cfg.openFirewall;
       dataDir = cfg.stateDir;
     };
 
diff --git a/nixarr/radarr/default.nix b/nixarr/radarr/default.nix
index 3e6827e..9fe9c7b 100644
--- a/nixarr/radarr/default.nix
+++ b/nixarr/radarr/default.nix
@@ -15,11 +15,19 @@ in {
     stateDir = mkOption {
       type = types.path;
       default = "${nixarr.stateDir}/radarr";
-      defaultText = literalExpression ''"''${nixarr.stateDir}/radarr"'';
+      defaultText = literalExpression ''!cfg.vpn.enable'';
       example = "/home/user/.local/share/nixarr/radarr";
       description = "The state directory for radarr.";
     };
 
+    openFirewall = mkOption {
+      type = types.bool;
+      defaultText = literalExpression ''"''${nixarr.vpn.enable}"'';
+      default = !cfg.vpn.enable;
+      example = true;
+      description = "Open firewall for Radarr";
+    };
+
     vpn.enable = mkOption {
       type = types.bool;
       default = false;
@@ -51,6 +59,7 @@ in {
       enable = cfg.enable;
       user = "radarr";
       group = "media";
+      openFirewall = cfg.openFirewall;
       dataDir = cfg.stateDir;
     };
 
diff --git a/nixarr/readarr/default.nix b/nixarr/readarr/default.nix
index e5258fe..1b27291 100644
--- a/nixarr/readarr/default.nix
+++ b/nixarr/readarr/default.nix
@@ -13,11 +13,19 @@ in {
     stateDir = mkOption {
       type = types.path;
       default = "${nixarr.stateDir}/readarr";
-      defaultText = literalExpression ''"''${nixarr.stateDir}/readarr"'';
+      defaultText = literalExpression ''!cfg.vpn.enable'';
       example = "/home/user/.local/share/nixarr/readarr";
       description = "The state directory for Readarr";
     };
 
+    openFirewall = mkOption {
+      type = types.bool;
+      defaultText = literalExpression ''"''${nixarr.vpn.enable}"'';
+      default = !cfg.vpn.enable;
+      example = true;
+      description = "Open firewall for Readarr";
+    };
+
     vpn.enable = mkOption {
       type = types.bool;
       default = false;
@@ -49,6 +57,7 @@ in {
       enable = cfg.enable;
       user = "readarr";
       group = "media";
+      openFirewall = cfg.openFirewall;
       dataDir = cfg.stateDir;
     };
 
diff --git a/nixarr/sonarr/default.nix b/nixarr/sonarr/default.nix
index 73cc144..600b329 100644
--- a/nixarr/sonarr/default.nix
+++ b/nixarr/sonarr/default.nix
@@ -19,11 +19,19 @@ in {
     stateDir = mkOption {
       type = types.path;
       default = "${nixarr.stateDir}/sonarr";
-      defaultText = literalExpression ''"''${nixarr.stateDir}/sonarr"'';
+      defaultText = literalExpression ''!cfg.vpn.enable'';
       example = "/home/user/.local/share/nixarr/sonarr";
       description = "The state directory for Sonarr.";
     };
 
+    openFirewall = mkOption {
+      type = types.bool;
+      defaultText = literalExpression ''"''${nixarr.vpn.enable}"'';
+      default = !cfg.vpn.enable;
+      example = true;
+      description = "Open firewall for Sonarr";
+    };
+
     vpn.enable = mkOption {
       type = types.bool;
       default = false;
@@ -55,6 +63,7 @@ in {
       enable = cfg.enable;
       user = "sonarr";
       group = "media";
+      openFirewall = cfg.openFirewall;
       dataDir = cfg.stateDir;
     };
 
diff --git a/nixarr/transmission/default.nix b/nixarr/transmission/default.nix
index 46bc728..d54a188 100644
--- a/nixarr/transmission/default.nix
+++ b/nixarr/transmission/default.nix
@@ -67,13 +67,21 @@ in {
     stateDir = mkOption {
       type = types.path;
       default = "${nixarr.stateDir}/transmission";
-      defaultText = literalExpression ''"''${nixarr.stateDir}/transmission"'';
+      defaultText = literalExpression ''!cfg.vpn.enable'';
       example = "/home/user/.local/share/nixarr/transmission";
       description = ''
         The state directory for Transmission.
       '';
     };
 
+    openFirewall = mkOption {
+      type = types.bool;
+      defaultText = literalExpression ''"''${nixarr.vpn.enable}"'';
+      default = !cfg.vpn.enable;
+      example = true;
+      description = "Open firewall for `peer-port` and `rpc-port`.";
+    };
+
     vpn.enable = mkOption {
       type = types.bool;
       default = false;
@@ -270,8 +278,8 @@ in {
         then pkgs.flood-for-transmission
         else null;
       package = pkgs.transmission_4;
-      openRPCPort = false;
-      openPeerPorts = !cfg.vpn.enable;
+      openRPCPort = cfg.openFirewall;
+      openPeerPorts = cfg.openFirewall;
       settings =
         {
           download-dir = downloadDir;