diff --git a/bundles/dovecot/metadata.py b/bundles/dovecot/metadata.py
index 3faa914..c51a93c 100644
--- a/bundles/dovecot/metadata.py
+++ b/bundles/dovecot/metadata.py
@@ -1,3 +1,5 @@
+from bundlewrap.metadata import atomic
+
 defaults = {
     'apt': {
         'packages': {
@@ -60,3 +62,22 @@ def import_database_settings_from_postfixadmin(metadata):
             },
         },
     }
+
+
+@metadata_reactor.provides(
+    'iptables/port_rules/143',
+    'iptables/port_rules/993',
+    'iptables/port_rules/4190',
+)
+def iptables(metadata):
+    return {
+        'iptables': {
+            'port_rules': {
+                # imap(s)
+                '143': atomic(metadata.get('dovecot/restrict-to', set('*'))),
+                '993': atomic(metadata.get('dovecot/restrict-to', set('*'))),
+                # managesieve
+                '4190': atomic(metadata.get('dovecot/restrict-to', set('*'))),
+            },
+        },
+    }