diff --git a/tfclient/src/config.rs b/tfclient/src/config.rs
index 8882b26..c14e62e 100644
--- a/tfclient/src/config.rs
+++ b/tfclient/src/config.rs
@@ -122,7 +122,22 @@ pub struct NebulaConfig {
     pub tun: Option<NebulaConfigTun>,
     #[serde(skip_serializing_if = "is_none")]
     pub logging: Option<NebulaConfigLogging>,
+    #[serde(skip_serializing_if = "is_none")]
+    pub sshd: Option<NebulaConfigSshd>,
 
+    // FIREWALL
+
+    #[serde(default = "u64_1")]
+    #[serde(skip_serializing_if = "is_u64_1")]
+    pub routines: u64,
+
+    #[serde(default = "none")]
+    #[serde(skip_serializing_if = "is_none")]
+    pub stats: Option<NebulaConfigStats>,
+
+    #[serde(default = "none")]
+    #[serde(skip_serializing_if = "is_none")]
+    pub local_range: Option<Ipv4Net>
 }
 
 #[derive(Serialize, Deserialize)]
@@ -306,6 +321,80 @@ pub enum NebulaConfigLoggingFormat {
     Text
 }
 
+#[derive(Serialize, Deserialize)]
+pub struct NebulaConfigSshd {
+    #[serde(default = "bool_false")]
+    #[serde(skip_serializing_if = "is_bool_false")]
+    pub enabled: bool,
+    pub listen: SocketAddrV4,
+    pub host_key: String,
+    #[serde(default = "empty_vec")]
+    #[serde(skip_serializing_if = "is_empty_vec")]
+    pub authorized_users: Vec<NebulaConfigSshdAuthorizedUser>
+}
+
+#[derive(Serialize, Deserialize)]
+pub struct NebulaConfigSshdAuthorizedUser {
+    pub user: String,
+    #[serde(default = "empty_vec")]
+    #[serde(skip_serializing_if = "is_empty_vec")]
+    pub keys: Vec<String>
+}
+
+#[derive(Serialize, Deserialize)]
+#[serde(tag = "type")]
+pub enum NebulaConfigStats {
+    #[serde(rename = "graphite")]
+    Graphite(NebulaConfigStatsGraphite),
+    #[serde(rename = "prometheus")]
+    Prometheus(NebulaConfigStatsPrometheus)
+}
+
+#[derive(Serialize, Deserialize)]
+pub struct NebulaConfigStatsGraphite {
+    #[serde(default = "string_nebula")]
+    #[serde(skip_serializing_if = "is_string_nebula")]
+    pub prefix: String,
+    #[serde(default = "protocol_tcp")]
+    #[serde(skip_serializing_if = "is_protocol_tcp")]
+    pub protocol: NebulaConfigStatsGraphiteProtocol,
+    pub host: SocketAddrV4,
+    pub interval: String,
+    #[serde(default = "bool_false")]
+    #[serde(skip_serializing_if = "is_bool_false")]
+    pub message_metrics: bool,
+    #[serde(default = "bool_false")]
+    #[serde(skip_serializing_if = "is_bool_false")]
+    pub lighthouse_metrics: bool
+}
+
+#[derive(Serialize, Deserialize)]
+pub enum NebulaConfigStatsGraphiteProtocol {
+    #[serde(rename = "tcp")]
+    Tcp,
+    #[serde(rename = "udp")]
+    Udp
+}
+
+#[derive(Serialize, Deserialize)]
+pub struct NebulaConfigStatsPrometheus {
+    pub listen: String,
+    pub path: String,
+    #[serde(default = "string_nebula")]
+    #[serde(skip_serializing_if = "is_string_nebula")]
+    pub namespace: String,
+    #[serde(default = "string_nebula")]
+    #[serde(skip_serializing_if = "is_string_nebula")]
+    pub subsystem: String,
+    pub interval: String,
+    #[serde(default = "bool_false")]
+    #[serde(skip_serializing_if = "is_bool_false")]
+    pub message_metrics: bool,
+    #[serde(default = "bool_false")]
+    #[serde(skip_serializing_if = "is_bool_false")]
+    pub lighthouse_metrics: bool
+}
+
 // Default values for serde
 fn empty_vec<T>() -> Vec<T> { vec![] }
 fn is_empty_vec<T>(v: &Vec<T>) -> bool { v.is_empty() }
@@ -358,4 +447,14 @@ fn is_format_text(f: &NebulaConfigLoggingFormat) -> bool { matches!(f, NebulaCon
 fn timestamp() -> String { "2006-01-02T15:04:05Z07:00".to_string() }
 fn is_timestamp(s: &str) -> bool { s == "2006-01-02T15:04:05Z07:00" }
 
+fn u64_1() -> u64 { 1 }
+fn is_u64_1(u: &u64) -> bool { *u == 1 }
+
+fn string_nebula() -> String { "nebula".to_string() }
+fn is_string_nebula(s: &str) -> bool { s == "nebula" }
+
+fn protocol_tcp() -> NebulaConfigStatsGraphiteProtocol { NebulaConfigStatsGraphiteProtocol::Tcp }
+fn is_protocol_tcp(p: &NebulaConfigStatsGraphiteProtocol) -> bool { matches!(p, NebulaConfigStatsGraphiteProtocol::Tcp) }
+
+fn none<T>() -> Option<T> { None }
 fn is_none<T>(o: &Option<T>) -> bool { o.is_none() }
\ No newline at end of file