diff --git a/homelab.yml b/homelab.yml
index 8128b6b..c534422 100644
--- a/homelab.yml
+++ b/homelab.yml
@@ -1,11 +1,15 @@
 # yaml-language-server: $schema=https://raw.githubusercontent.com/ansible/ansible-lint/main/src/ansiblelint/schemas/playbook.json
 ---
 - name: Homelab alignment
-  hosts: online
+  hosts: managed
   become: true
 
   roles:
-    - role: repos
-    - role: common
     - role: ufw
+      tags: ufw
+
+    - role: repos
+      tags: repos
+
     - role: upgrade
+      tags: upgrade
diff --git a/roles/ufw/defaults/main.yml b/roles/ufw/defaults/main.yml
index bef122b..869a23f 100644
--- a/roles/ufw/defaults/main.yml
+++ b/roles/ufw/defaults/main.yml
@@ -1,4 +1,5 @@
 # roles/ufw/defaults/main.yml
 ---
+ufw_default_incoming_policy: deny
+ufw_default_outgoing_policy: allow
 ufw_tailscale_interface: tailscale0
-ufw_extra_rules: []
diff --git a/roles/ufw/tasks/main.yml b/roles/ufw/tasks/main.yml
index e69de29..ddbc547 100644
--- a/roles/ufw/tasks/main.yml
+++ b/roles/ufw/tasks/main.yml
@@ -0,0 +1,5 @@
+- name: Allow all traffic on Tailscale interface
+  community.general.ufw:
+    rule: allow
+    interface: "{{ ufw_tailscale_interface }}"
+    direction: in