diff --git a/group_vars/all.yaml b/group_vars/all.yaml
index 928e710..18728b5 100644
--- a/group_vars/all.yaml
+++ b/group_vars/all.yaml
@@ -14,6 +14,7 @@ trusted_ranges:
   - { v: ipv4, cidr: "100.64.0.0/10", comment: "bitlair" }
   - { v: ipv4, cidr: "185.205.52.194/32", comment: "bitlair A2B" } # kan weg ??
   - { v: ipv4, cidr: "31.187.251.213/32", comment: "foobar thuis" }
+  - { v: ipv4, cidr: "185.205.53.40/32", comment: "ak / koopen.net" }
 #  - { v: ipv6, cidr: "::/0", comment: "ipv6 localhost" }
 #  - { v: ipv6, cidr: "fe80::/10", comment: "ipv6 link-local" }
 #  - { v: ipv6, cidr: "2a02:166b:92::/48", comment: "bitlair" } # /48's kunnen niet in de ipset
diff --git a/group_vars/fotos.yaml b/group_vars/fotos.yaml
index 9ab05d7..ce3dc05 100644
--- a/group_vars/fotos.yaml
+++ b/group_vars/fotos.yaml
@@ -5,3 +5,8 @@ root_access:
   - linor
   - polyfloyd
   - wilco
+
+group_nft_input:
+  - "# Allow traffic from wiki"
+  - "ip saddr 204.2.64.19 tcp dport { 4567 } accept"
+
diff --git a/group_vars/mqtt.yaml b/group_vars/mqtt.yaml
index 3b2167b..5b4604d 100644
--- a/group_vars/mqtt.yaml
+++ b/group_vars/mqtt.yaml
@@ -2,3 +2,7 @@
 
 nft_group_rules:
   - { version: "ip6", from: [ '2001:470:7f95::/48' ], port: "1883" }
+
+group_nft_input:
+  - ip saddr @trusted4 tcp dport { 1883 } accept
+  - ip6 saddr @trusted6 tcp dport { 1883 } accept