diff --git a/host_firewall/defaults/main.yml b/host_firewall/defaults/main.yml
index a2b6f9b..a763e28 100644
--- a/host_firewall/defaults/main.yml
+++ b/host_firewall/defaults/main.yml
@@ -18,8 +18,6 @@ firewall:
     tcp: {}
     v4: {}
     v6: {}
-  # Ports accepted from the listed addresses alone: name -> {tcp: ports, v4: addresses, v6: addresses}, each a map as above.
-  sources: {}
   # Metrics scrapers: on wt0 only these source addresses reach the listed tcp
   # ports (the vpn zone applies to every peer). Rendered only when both are set.
   scrapers:
diff --git a/host_firewall/templates/host.nft.j2 b/host_firewall/templates/host.nft.j2
index ea64236..e0ee024 100644
--- a/host_firewall/templates/host.nft.j2
+++ b/host_firewall/templates/host.nft.j2
@@ -367,14 +367,6 @@ table inet host {
 {% if list(firewall.public.udp) %}
 		udp dport { {{ list(firewall.public.udp) }} } accept
 {% endif %}
-{% for src in firewall.sources | default({}, true) | dict2items | rejectattr('value', 'none') | map(attribute='value') %}
-{% if list(src.tcp) and list(src.v4) %}
-		ip saddr { {{ list(src.v4) }} } tcp dport { {{ list(src.tcp) }} } accept
-{% endif %}
-{% if list(src.tcp) and list(src.v6) %}
-		ip6 saddr { {{ list(src.v6) }} } tcp dport { {{ list(src.tcp) }} } accept
-{% endif %}
-{% endfor %}
 {% if list(firewall.geo.tcp) %}
 		tcp dport { {{ list(firewall.geo.tcp) }} } jump geo
 {% endif %}