diff --git a/hosts/asusmini/default.nix b/hosts/asusmini/default.nix
index 0a34b5f..5da03d2 100644
--- a/hosts/asusmini/default.nix
+++ b/hosts/asusmini/default.nix
@@ -96,14 +96,14 @@
   };
 
   # Open ports in the firewall.
-  networking.firewall.allowedTCPPorts = [ 22 80 443 ];
-  # Allow the CC edge (Caddy LXC on pve, 192.168.1.11) + LAN to reach the
-  # service ports directly; the public entry point moves off this box to
-  # 205.250.24.44 -> pve Caddy (see cc-ansible wiki / onboard plan).
+  # NOTE (2026-09-28): extraInputRules is nftables-backend-only and this box
+  # runs the default iptables backend — the src-scoped rule from PR #1 was a
+  # silent no-op (verified: ports stayed blocked from LAN after rebuild).
+  # allowedTCPPorts is backend-agnostic. Source-scoping is unnecessary now:
+  # the public forwards move off this box (205.250.24.44 -> pve Caddy LXC
+  # .1.11), leaving LAN (Z_DMZ) + tailnet as the only ingress paths.
   # Tailnet traffic already bypasses this (tailscale0 not restricted).
-  networking.firewall.extraInputRules = ''
-    ip saddr 192.168.1.0/24 tcp dport { 5555, 5556, 6555, 3030 } accept
-  '';
+  networking.firewall.allowedTCPPorts = [ 22 80 443 5555 5556 6555 3030 ];
   # networking.firewall.allowedUDPPorts = [ ... ];
   # Or disable the firewall altogether.
   # networking.firewall.enable = false;