diff --git a/ansible/roles/wireguard/tasks/main.yml b/ansible/roles/wireguard/tasks/main.yml
index 03ecf01..cefde30 100644
--- a/ansible/roles/wireguard/tasks/main.yml
+++ b/ansible/roles/wireguard/tasks/main.yml
@@ -55,17 +55,25 @@
     state: started
     daemon_reload: true
 
-- name: Allow WireGuard UDP port from admin CIDRs
+- name: Remove old WireGuard UDP port rich rules from admin CIDRs
   ansible.posix.firewalld:
     rich_rule: >-
       rule family="ipv4" source address="{{ item }}"
       port port="{{ wireguard_port }}" protocol="udp" accept
     zone: drop
-    state: enabled
+    state: disabled
     permanent: true
     immediate: true
   loop: "{{ admin_allowed_cidrs.split(' ') }}"
 
+- name: Allow WireGuard UDP port globally (auth via crypt key)
+  ansible.posix.firewalld:
+    port: "{{ wireguard_port }}/udp"
+    zone: drop
+    state: enabled
+    permanent: true
+    immediate: true
+
 - name: Allow DB ports from WireGuard subnet only
   ansible.posix.firewalld:
     rich_rule: >-