diff --git a/nixos/modules/services/networking/pihole-ftl.md b/nixos/modules/services/networking/pihole-ftl.md
index 4a1b1f986708..0f79fd6101c4 100644
--- a/nixos/modules/services/networking/pihole-ftl.md
+++ b/nixos/modules/services/networking/pihole-ftl.md
@@ -22,6 +22,7 @@ Example configuration:
 {
   services.pihole-ftl = {
     enable = true;
+    openFirewallDNS = true;
     openFirewallDHCP = true;
     queryLogDeleter.enable = true;
     lists = [
diff --git a/nixos/modules/services/networking/pihole-ftl.nix b/nixos/modules/services/networking/pihole-ftl.nix
index bda8ab4fa8c8..5a8c361adfeb 100644
--- a/nixos/modules/services/networking/pihole-ftl.nix
+++ b/nixos/modules/services/networking/pihole-ftl.nix
@@ -56,6 +56,12 @@ in
       example = "3";
     };
 
+    openFirewallDNS = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Open ports in the firewall for pihole-FTL's DNS server.";
+    };
+
     openFirewallDHCP = mkOption {
       type = types.bool;
       default = false;
@@ -434,11 +440,15 @@ in
     };
 
     networking.firewall = lib.mkMerge [
-      (mkIf cfg.openFirewallDHCP {
+      (mkIf cfg.openFirewallDNS {
         allowedUDPPorts = [ 53 ];
         allowedTCPPorts = [ 53 ];
       })
 
+      (mkIf cfg.openFirewallDHCP {
+        allowedUDPPorts = [ 67 ];
+      })
+
       (mkIf cfg.openFirewallWebserver {
         allowedTCPPorts = lib.pipe cfg.settings.webserver.port [
           (lib.splitString ",")