diff --git a/bundles/jellyfin/metadata.py b/bundles/jellyfin/metadata.py
index 5728913..d3d6003 100644
--- a/bundles/jellyfin/metadata.py
+++ b/bundles/jellyfin/metadata.py
@@ -55,3 +55,15 @@ def nginx(metadata):
             },
         },
     }
+
+@metadata_reactor.provides(
+    'firewall/port_rules',
+)
+def firewall(metadata):
+    return {
+        'firewall': {
+            'port_rules': {
+                '8096/tcp': atomic(metadata.get('jellyfin/restrict-to', {'*'})),
+            },
+        },
+    }
diff --git a/nodes/home/nas.py b/nodes/home/nas.py
index 7befeb9..e7121ab 100644
--- a/nodes/home/nas.py
+++ b/nodes/home/nas.py
@@ -95,6 +95,11 @@ nodes['home.nas'] = {
                 },
             },
         },
+        'jellyfin': {
+            'restrict-to': {
+                'home.lgtv-wohnzimmer',
+            },
+        },
         'mosquitto': {
             'bridges': {
                 'c3voc': {