diff --git a/hosts/vps/configuration.nix b/hosts/vps/configuration.nix
index 91c8376..99e4aaa 100644
--- a/hosts/vps/configuration.nix
+++ b/hosts/vps/configuration.nix
@@ -12,9 +12,6 @@ let
   wgGuestsSubnet = "${config.my.ips.wg-gs}/24";
   wgServerSubnet = "${config.my.ips.wg-vps}/24";
   wgFriend1 = config.my.ips.wg-friend1;
-  wgFriend2 = config.my.ips.wg-friend2;
-  wgFriend3 = config.my.ips.wg-friend3;
-  wgFriend4 = config.my.ips.wg-friend4;
   wgGuest1 = config.my.ips.wg-g1;
   giteaSshPort = 22;
   giteaSshPortStr = toString giteaSshPort;
@@ -65,7 +62,7 @@ in
     };
     nftables = {
       enable = true;
-      tables."vps-snat" = {
+      tables.vps-snat = {
         family = "ip";
         content = ''
           chain postrouting {
@@ -82,14 +79,8 @@ in
       allowedTCPPorts = [ sshPort ] ++ webPorts;
       allowedUDPPorts = [ wgPort ];
       extraForwardRules = ''
-        iifname "${wgInterface}" ip saddr ${wgFriend1}/32 ip daddr ${homeServer}/32 tcp dport ${syncthingPort} accept
-        iifname "${wgInterface}" ip saddr ${wgFriend2}/32 ip daddr ${homeServer}/32 tcp dport ${syncthingPort} accept
-        iifname "${wgInterface}" ip saddr ${wgFriend3}/32 ip daddr ${homeServer}/32 tcp dport ${syncthingPort} accept
-        iifname "${wgInterface}" ip saddr ${wgFriend4}/32 ip daddr ${homeServer}/32 tcp dport ${syncthingPort} accept
-        iifname "${wgInterface}" ip saddr ${homeServer}/32 ip daddr ${wgFriend1}/32 tcp dport ${syncthingPort} accept
-        iifname "${wgInterface}" ip saddr ${homeServer}/32 ip daddr ${wgFriend2}/32 tcp dport ${syncthingPort} accept
-        iifname "${wgInterface}" ip saddr ${homeServer}/32 ip daddr ${wgFriend3}/32 tcp dport ${syncthingPort} accept
-        iifname "${wgInterface}" ip saddr ${homeServer}/32 ip daddr ${wgFriend4}/32 tcp dport ${syncthingPort} accept
+        iifname "${wgInterface}" ip saddr ${wgFriendsSubnet} ip daddr ${homeServer}/32 tcp dport ${syncthingPort} accept
+        iifname "${wgInterface}" ip saddr ${homeServer}/32 ip daddr ${wgFriendsSubnet} tcp dport ${syncthingPort} accept
 
         iifname "${wgInterface}" ip saddr ${wgFriendsSubnet} ip daddr ${homeServer}/32 tcp dport { ${synapseClientPort}, ${synapseFederationPort}, ${syncplayPort} } accept
 
@@ -101,8 +92,6 @@ in
         iifname "${wgInterface}" ip saddr ${wgFriendsSubnet} oifname "${externalInterface}" accept
         iifname "${wgInterface}" ip saddr ${wgGuestsSubnet} oifname "${externalInterface}" accept
 
-        iifname "${externalInterface}" ip daddr ${homeServer}/32 tcp dport ${giteaSshPortStr} accept
-
         ip saddr ${wgFriendsSubnet} ip daddr ${wgServerSubnet} drop
         ip saddr ${wgServerSubnet} ip daddr ${wgFriendsSubnet} drop
         ip saddr ${wgGuestsSubnet} ip daddr ${wgServerSubnet} drop