diff --git a/proxmox/config/pve-firewall/cluster.fw.example b/proxmox/config/pve-firewall/cluster.fw.example
index f25ae41..8a4faa6 100644
--- a/proxmox/config/pve-firewall/cluster.fw.example
+++ b/proxmox/config/pve-firewall/cluster.fw.example
@@ -33,6 +33,9 @@ IN ACCEPT -source +mgmt -p tcp -dport 22 -log nolog
 # docs/06-pve-test-wifi-network.md for a case this caused real confusion.
 IN ACCEPT -source +mgmt -p icmp -icmp-type echo-request -log nolog
 
+# Beszel monitoring agent - the hub polls the agent on this port
+IN ACCEPT -source +mgmt -p tcp -dport 45876 -log nolog
+
 # Stage 2: Corosync (cluster quorum) - uncomment once node 2/3 join and
 # the corosync network/VLAN exists.
 # IN ACCEPT -source <COROSYNC_CIDR> -p udp -dport 5404:5405 -log nolog