diff --git a/hosts/metronom/networking.nix b/hosts/metronom/networking.nix
index b309ec3..380c220 100644
--- a/hosts/metronom/networking.nix
+++ b/hosts/metronom/networking.nix
@@ -16,7 +16,4 @@
   networking.enableIPv6 = true;
   networking.useDHCP = false;
   networking.interfaces."enp1s0".useDHCP = true;
-
-  # TODO: ssh via wireguard only
-  services.openssh.openFirewall = true;
 }
diff --git a/hosts/tankstelle/networking.nix b/hosts/tankstelle/networking.nix
index 1ef2e26..8e89392 100644
--- a/hosts/tankstelle/networking.nix
+++ b/hosts/tankstelle/networking.nix
@@ -35,7 +35,4 @@
       ];
     };
   };
-
-  # TODO: ssh via wireguard only
-  services.openssh.openFirewall = true;
 }
diff --git a/hosts/tankstelle/wireguard.nix b/hosts/tankstelle/wireguard.nix
index d8979eb..ceb430b 100644
--- a/hosts/tankstelle/wireguard.nix
+++ b/hosts/tankstelle/wireguard.nix
@@ -41,14 +41,14 @@
     };
   };
 
-  #services.openssh.listenAddresses = [
-  #  {
-  #    addr = "10.7.6.4";
-  #    port = 22;
-  #  }
-  #  {
-  #    addr = "[fd00:fae:fae:fae:fae:4::]";
-  #    port = 22;
-  #  }
-  #];
+  services.openssh.listenAddresses = [
+    {
+      addr = "10.7.6.4";
+      port = 22;
+    }
+    {
+      addr = "[fd00:fae:fae:fae:fae:4::]";
+      port = 22;
+    }
+  ];
 }