diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
index a97758dc3..c7627bcab 100644
--- a/src/initscripts/system/firewall
+++ b/src/initscripts/system/firewall
@@ -2,7 +2,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2022  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2026  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -443,7 +443,9 @@ iptables_init() {
 	/usr/local/bin/captivectrl
 
 	# Grant Knot Resolver access
-	iptables -A LOCAL_OUTPUT -m owner --uid-owner knot-resolver -j ACCEPT
+	iptables -A LOCAL_OUTPUT -m owner --uid-owner knot-resolver -p udp --dport  53 -j ACCEPT
+	iptables -A LOCAL_OUTPUT -m owner --uid-owner knot-resolver -p tcp --dport  53 -j ACCEPT
+	iptables -A LOCAL_OUTPUT -m owner --uid-owner knot-resolver -p tcp --dport 853 -j ACCEPT
 
 	# If a Tor relay is enabled apply firewall rules
 	if [ "${TOR_RELAY_ENABLED}" = "on" -a -n "${TOR_RELAY_PORT}" ]; then