diff --git a/plinth/modules/firewall/__init__.py b/plinth/modules/firewall/__init__.py
index 779282633..1b559fbca 100644
--- a/plinth/modules/firewall/__init__.py
+++ b/plinth/modules/firewall/__init__.py
@@ -81,7 +81,7 @@ class FirewallApp(app_module.App):
     def setup(self, old_version):
         """Install and configure the app."""
         super().setup(old_version)
-        _run_setup()
+        privileged.setup()
 
     def force_upgrade(self, packages):
         """Force upgrade firewalld to resolve conffile prompts."""
@@ -94,7 +94,7 @@ class FirewallApp(app_module.App):
             return False
 
         install(['firewalld'], force_configuration='new')
-        _run_setup()
+        privileged.setup()
         return True
 
     def diagnose(self) -> list[DiagnosticCheck]:
@@ -107,17 +107,6 @@ class FirewallApp(app_module.App):
         return results
 
 
-def _run_setup():
-    """Run firewalld setup."""
-    privileged.setup()
-    add_service('http', 'external')
-    add_service('http', 'internal')
-    add_service('https', 'external')
-    add_service('https', 'internal')
-    add_service('dns', 'internal')
-    add_service('dhcp', 'internal')
-
-
 def _get_dbus_proxy(object, interface):
     """Return a DBusProxy for a given firewalld object and interface."""
     connection = gio.bus_get_sync(gio.BusType.SYSTEM)
diff --git a/plinth/modules/networks/__init__.py b/plinth/modules/networks/__init__.py
index 54371feda..f71dc5f72 100644
--- a/plinth/modules/networks/__init__.py
+++ b/plinth/modules/networks/__init__.py
@@ -10,6 +10,7 @@ from plinth import app as app_module
 from plinth import daemon, kvstore, menu, network
 from plinth.config import DropinConfigs
 from plinth.diagnostic_check import DiagnosticCheck
+from plinth.modules.firewall.components import Firewall
 from plinth.package import Packages
 
 from . import privileged
@@ -69,6 +70,11 @@ class NetworksApp(app_module.App):
         packages = Packages('packages-networks', ['network-manager', 'batctl'])
         self.add(packages)
 
+        # For 'shared' network connections
+        firewall = Firewall('firewall-networks', info.name,
+                            ports=['dns', 'dhcp'], is_external=False)
+        self.add(firewall)
+
         dropin_configs = DropinConfigs('dropin-configs-networks', [
             '/etc/NetworkManager/dispatcher.d/10-freedombox-batman',
         ])