diff --git a/bundles/powerdns/metadata.py b/bundles/powerdns/metadata.py
index 57f46f5..3cf5d4e 100644
--- a/bundles/powerdns/metadata.py
+++ b/bundles/powerdns/metadata.py
@@ -211,8 +211,9 @@ def firewall(metadata):
     return {
         'firewall': {
             'port_rules': {
-                '53': atomic(metadata.get('powerdns/restrict-to', {'*'})),
-                '53/udp': atomic(metadata.get('powerdns/restrict-to', {'*'})),
+                '53': atomic(metadata.get('powerdns/restrict-to/dns', {'*'})),
+                '53/udp': atomic(metadata.get('powerdns/restrict-to/dns', {'*'})),
+                '8081': atomic(metadata.get('powerdns/restrict-to/api', set())),
             },
         },
     }