diff --git a/configuration.nix b/configuration.nix
index 124af9a..89b9c2d 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -254,6 +254,7 @@ in
             config = [
               {
                 volumes.enabled = true;
+                allow_privileged = true;
               }
             ];
           }
@@ -266,36 +267,45 @@ in
   networking.firewall = {
     allowedTCPPorts = [
       (builtins.head ({ openssh.ports = [22]; } // node_config.services).openssh.ports)
-      #3990 3991 3992          # Garage
-      #4646 4647 4648          # Nomad
-      #8500 8300 8301 8302     # Consul
-      #19999                   # Netdata
     ];
     allowedUDPPorts = [
-      #4648                    # Nomad
-      #8301 8302               # Consul
       node_config.networking.wireguard.interfaces.wg0.listenPort
     ];
+
+    # Authorize nodes also on the Wireguard VPN to access services running here
     extraCommands = ''
+      # Allow everything from router (usefull for UPnP/IGD)
+      iptables -A INPUT -s 192.168.1.254 -j ACCEPT
+
       iptables -N VPN
       iptables -A INPUT -s 10.42.0.0/16 -j VPN
-      iptables -A VPN -p tcp --dport 3990 -j ACCEPT
-      iptables -A VPN -p tcp --dport 3991 -j ACCEPT
-      iptables -A VPN -p tcp --dport 3992 -j ACCEPT
+
+      # Nomad
       iptables -A VPN -p tcp --dport 4646 -j ACCEPT
       iptables -A VPN -p tcp --dport 4647 -j ACCEPT
       iptables -A VPN -p tcp --dport 4648 -j ACCEPT
       iptables -A VPN -p udp --dport 4648 -j ACCEPT
+
+      # Consul
       iptables -A VPN -p tcp --dport 8500 -j ACCEPT
       iptables -A VPN -p tcp --dport 8300 -j ACCEPT
       iptables -A VPN -p tcp --dport 8301 -j ACCEPT
       iptables -A VPN -p tcp --dport 8302 -j ACCEPT
       iptables -A VPN -p udp --dport 8301 -j ACCEPT
       iptables -A VPN -p udp --dport 8302 -j ACCEPT
+
+      # Garage
+      iptables -A VPN -p tcp --dport 3990 -j ACCEPT
+      iptables -A VPN -p tcp --dport 3991 -j ACCEPT
+      iptables -A VPN -p tcp --dport 3992 -j ACCEPT
+
+      # Netdata monitoring
       iptables -A VPN -p tcp --dport 19999 -j ACCEPT
     '';
-    #flush the chain then remove it
+
+    # When stopping firewall, delete filtering VPN chain
     extraStopCommands = ''
+      iptables -D INPUT -s 192.168.1.254 -j ACCEPT
       iptables -D INPUT -s 10.42.0.0/16 -j VPN
       iptables -F VPN
       iptables -X VPN
diff --git a/site/neptune.nix b/site/neptune.nix
index 13e0e21..f640fc1 100644
--- a/site/neptune.nix
+++ b/site/neptune.nix
@@ -8,6 +8,7 @@
 
   services.nomad.settings.datacenter = "neptune";
 
+  # Allow router to reach nodes in this site
   networking.firewall.allowedTCPPorts = [ 80 443 ];
 
   # ----