diff --git a/modules/firewall/default.nix b/modules/firewall/default.nix
index fa4d99c..17817b9 100644
--- a/modules/firewall/default.nix
+++ b/modules/firewall/default.nix
@@ -59,6 +59,7 @@ in
             extraRules = mkOption {
               type = types.attrsOf types.attrs;
               description = "firewall ruleset";
+              default = {};
             };
             rules = mkOption {
               type = types.attrsOf types.attrs;   # we could usefully tighten this a bit :-)