diff --git a/salt/firewall/defaults.yaml b/salt/firewall/defaults.yaml
index 0b6d06eda..6dd3fead3 100644
--- a/salt/firewall/defaults.yaml
+++ b/salt/firewall/defaults.yaml
@@ -405,7 +405,6 @@ firewall:
                 - docker_registry
                 - influxdb
                 - sensoroni
-                - kafka
             searchnode:
               portgroups:
                 - redis
@@ -433,6 +432,7 @@ firewall:
                 - elastic_agent_data
                 - elastic_agent_update
                 - sensoroni
+                - kafka
             receiver:
               portgroups:
                 - yum
@@ -442,6 +442,7 @@ firewall:
                 - elastic_agent_data
                 - elastic_agent_update
                 - sensoroni
+                - kafka
             analyst:
               portgroups:
                 - nginx
@@ -566,6 +567,7 @@ firewall:
                 - elastic_agent_update
                 - localrules
                 - sensoroni
+                - kafka
             fleet:
               portgroups:
                 - elasticsearch_rest
@@ -613,6 +615,7 @@ firewall:
                 - elastic_agent_data
                 - elastic_agent_update
                 - sensoroni
+                - kafka
             heavynode:
               portgroups:
                 - redis
@@ -625,6 +628,7 @@ firewall:
                 - elastic_agent_data
                 - elastic_agent_update
                 - sensoroni
+                - kafka
             receiver:
               portgroups:
                 - yum
@@ -761,7 +765,7 @@ firewall:
                 - beats_5044
                 - beats_5644
                 - beats_5056
-                - redis
+                - kafka
                 - elasticsearch_node
                 - elastic_agent_control
                 - elastic_agent_data
@@ -813,6 +817,7 @@ firewall:
                 - redis
                 - elasticsearch_rest
                 - elasticsearch_node
+                - kafka
             heavynode:
               portgroups:
                 - docker_registry
@@ -822,6 +827,7 @@ firewall:
                 - redis
                 - elasticsearch_rest
                 - elasticsearch_node
+                - kafka
             receiver:
               portgroups:
                 - yum
@@ -1289,6 +1295,9 @@ firewall:
                 - redis
                 - beats_5644
                 - kafka
+            manager:
+              portgroups:
+                - kafka
             managersearch:
               portgroups:
                 - redis