diff --git a/host_firewall/defaults/main.yml b/host_firewall/defaults/main.yml
index a763e28..a2b6f9b 100644
--- a/host_firewall/defaults/main.yml
+++ b/host_firewall/defaults/main.yml
@@ -18,6 +18,8 @@ firewall:
     tcp: {}
     v4: {}
     v6: {}
+  # Ports accepted from the listed addresses alone: name -> {tcp: ports, v4: addresses, v6: addresses}, each a map as above.
+  sources: {}
   # Metrics scrapers: on wt0 only these source addresses reach the listed tcp
   # ports (the vpn zone applies to every peer). Rendered only when both are set.
   scrapers:
diff --git a/host_firewall/templates/host.nft.j2 b/host_firewall/templates/host.nft.j2
index e0ee024..ea64236 100644
--- a/host_firewall/templates/host.nft.j2
+++ b/host_firewall/templates/host.nft.j2
@@ -367,6 +367,14 @@ table inet host {
 {% if list(firewall.public.udp) %}
 		udp dport { {{ list(firewall.public.udp) }} } accept
 {% endif %}
+{% for src in firewall.sources | default({}, true) | dict2items | rejectattr('value', 'none') | map(attribute='value') %}
+{% if list(src.tcp) and list(src.v4) %}
+		ip saddr { {{ list(src.v4) }} } tcp dport { {{ list(src.tcp) }} } accept
+{% endif %}
+{% if list(src.tcp) and list(src.v6) %}
+		ip6 saddr { {{ list(src.v6) }} } tcp dport { {{ list(src.tcp) }} } accept
+{% endif %}
+{% endfor %}
 {% if list(firewall.geo.tcp) %}
 		tcp dport { {{ list(firewall.geo.tcp) }} } jump geo
 {% endif %}