diff --git a/examples/demo-firewall.nix b/examples/demo-firewall.nix
index 3f381a5..58d6fbf 100644
--- a/examples/demo-firewall.nix
+++ b/examples/demo-firewall.nix
@@ -107,6 +107,7 @@ in {
 
     rules = [
       (accept "udp dport 547") # dhcp, could restrict to daddr ff02::1:2
+      (accept "udp dport 53") # dns
       (accept "tcp dport 22")
     ];
   };