diff --git a/firewall/templates/iptables.erb b/firewall/templates/iptables.erb
index df2c8e7..fbddd39 100644
--- a/firewall/templates/iptables.erb
+++ b/firewall/templates/iptables.erb
@@ -11,6 +11,9 @@
 <%   rule = /(tcp|udp)\/(\d+)( .+)?/.match(rule) -%>
 -A INPUT<% if rule[1] == "tcp" %> -m state --state NEW<% end %> -m <%= rule[1] %> -p <%= rule[1] %><% if rule[3] %> -s<%= rule[3] %><% end %> --dport <%= rule[2] %> -j ACCEPT
 <% end -%>
+<% firewall_custom.each do |rule| -%>
+<%= rule %>
+<% end -%>
 -A INPUT -p tcp -j REJECT --reject-with tcp-reset
 -A INPUT -j REJECT --reject-with icmp-port-unreachable
 -A FORWARD -j REJECT --reject-with icmp-host-prohibited
diff --git a/firewall/templates/pf.conf.erb b/firewall/templates/pf.conf.erb
index cf59fa7..71acd23 100644
--- a/firewall/templates/pf.conf.erb
+++ b/firewall/templates/pf.conf.erb
@@ -15,5 +15,8 @@ pass in quick inet6 proto icmp6 all
 <%   rule = /(tcp|udp)\/(\d+)( .+)?/.match(rule) -%>
 pass in quick proto <%= rule[1] %><% if rule[3] %> from<%= rule[3] %><% end %> to port <%= rule[2] %>
 <% end -%>
+<% firewall_custom.each do |rule| -%>
+<%= rule %>
+<% end -%>
 
 pass out quick all