diff --git a/devices/srv1/node0/default.nix b/devices/srv1/node0/default.nix
index 8b70a397..59b78190 100644
--- a/devices/srv1/node0/default.nix
+++ b/devices/srv1/node0/default.nix
@@ -55,5 +55,8 @@ inputs:
         options = [ "rbind" ];
       };
     };
+    # without this, tproxy does not work
+    # TODO: why?
+    networking.firewall.trustedInterfaces = [ "eno146" ];
   };
 }