diff --git a/files/firewall b/files/firewall
index c63479d..b9d3612 100755
--- a/files/firewall
+++ b/files/firewall
@@ -101,6 +101,9 @@ case $1 in
         ip6tables -A INPUT -s 2604:bbc0:0:113::1                             -p udp   --sport    53                       -j ACCEPT   # dns replies from bastion
         ip6tables -A INPUT -s 2604:bbc0:0:113::b                             -p tcp   --dport    22                       -j ACCEPT   # ssh from bastion2
         ip6tables -A INPUT -s 2604:bbc0:0:113::b                             -p udp   --sport    53                       -j ACCEPT   # dns replies from bastion2
+        ip6tables -A INPUT -s 2600:1f14:3f:1b01:e296:593a:484a:64d2          -p tcp   --sport    9091                     -j ACCEPT   # prometheus pushgateway
+        ip6tables -A INPUT -s 2600:1f14:3f:1b01:e296:593a:484a:64d2          -p tcp   --sport    9103                     -j ACCEPT   # prometheus collectd-exporter
+
 
        ## traffic we want to see encrypted over the VPN
         ip6tables -A INPUT -m policy --pol ipsec --dir in                    -p tcp   --dport    22                       -j ACCEPT   # ssh if coming over the VPN