diff --git a/README.md b/README.md
index fcc4af9..38cdcc7 100644
--- a/README.md
+++ b/README.md
@@ -63,6 +63,13 @@ lxc-helpers.sh lxc_install_lxc $name $ipv4 $ipv6
 lxc-helpers.sh lxc_container_user_install $name $(id -u) $USER
 ```
 
+## firewall
+
+Hetzner hosts have a firewall that must be configured from
+https://robot.hetzner.com/server to only allow incoming ssh, http,
+https requests for both IPv4 & IPv6. Each server has a "Firewall" tab
+that provides control over this firewall.
+
 ## nftables
 
 ```sh