diff --git a/stun/debian/control b/stun/debian/control
index 40e220d8..c33c6078 100644
--- a/stun/debian/control
+++ b/stun/debian/control
@@ -15,6 +15,7 @@ Package: ooni-stun
 Architecture: all
 Depends: ${misc:Depends},
  ${python3:Depends},
+ nftables,
  python3-setuptools,
  python3-statsd,
  python3-systemd,
diff --git a/stun/debian/install b/stun/debian/install
index c031a863..e744e437 100644
--- a/stun/debian/install
+++ b/stun/debian/install
@@ -1,2 +1,3 @@
 debian/ooni-stun.service /lib/systemd/system/
+debian/udp_3478.nft /etc/ooni/nftables/udp_3478.nft
 ooni-stun.py /usr/bin/
diff --git a/stun/debian/udp_3478.nft b/stun/debian/udp_3478.nft
new file mode 100644
index 00000000..87ef40ec
--- /dev/null
+++ b/stun/debian/udp_3478.nft
@@ -0,0 +1,2 @@
+# Deployed as /etc/ooni/nftables/udp_3478.nft by the ooni-stun deb package
+add rule inet filter input udp dport 3478 counter accept comment "Incoming STUN"