diff --git a/roles/prereq/tasks/main.yml b/roles/prereq/tasks/main.yml
index 529b63c..b9b7a94 100644
--- a/roles/prereq/tasks/main.yml
+++ b/roles/prereq/tasks/main.yml
@@ -128,6 +128,7 @@
       when:
         - "'Status: active' in prereq_ufw_status['stdout']"
         - groups[server_group] | length > 1
+        - not (use_external_database | default(false) | bool)
       community.general.ufw:
         rule: allow
         port: "2379:2381"
@@ -170,7 +171,9 @@
         immediate: true
 
     - name: If firewalld enabled, open etcd ports
-      when: groups[server_group] | length > 1
+      when:
+        - groups[server_group] | length > 1
+        - not (use_external_database | default(false) | bool)
       ansible.posix.firewalld:
         port: "2379-2381/tcp"
         zone: internal
diff --git a/roles/prereq/templates/k3s.nft.j2 b/roles/prereq/templates/k3s.nft.j2
index 45794bb..27200c4 100644
--- a/roles/prereq/templates/k3s.nft.j2
+++ b/roles/prereq/templates/k3s.nft.j2
@@ -9,7 +9,7 @@ insert rule inet filter input ip saddr {{ hostvars[host].ansible_default_ipv4.ad
 
 # K3s core ports
 insert rule inet filter input tcp dport {{ api_port | default(6443) }} accept
-{% if groups[server_group] | length > 1 %}
+{% if groups[server_group] | length > 1 and not (use_external_database | default(false) | bool) %}
 insert rule inet filter input tcp dport 2379-2381 accept
 {% endif %}
 
@@ -28,4 +28,4 @@ insert rule inet filter input udp dport 30000-32767 accept
 
 # Keep forward traffic open for CNI/pod networking
 insert rule inet filter forward ct state established,related accept
-insert rule inet filter forward accept
\ No newline at end of file
+insert rule inet filter forward accept