diff --git a/salt/sys-syncthing/files/admin/firewall/qvm-port-forward b/salt/dom0/files/bin/qvm-port-forward
similarity index 100%
rename from salt/sys-syncthing/files/admin/firewall/qvm-port-forward
rename to salt/dom0/files/bin/qvm-port-forward
diff --git a/salt/dom0/init.sls b/salt/dom0/init.sls
index 9043ff9..a6a8211 100644
--- a/salt/dom0/init.sls
+++ b/salt/dom0/init.sls
@@ -8,6 +8,7 @@ SPDX-License-Identifier: AGPL-3.0-or-later
 
 include:
   - .install
+  - .port-forward
   - .backup
   - .xorg
   - .kde
diff --git a/salt/dom0/port-forward.sls b/salt/dom0/port-forward.sls
new file mode 100644
index 0000000..665d5e2
--- /dev/null
+++ b/salt/dom0/port-forward.sls
@@ -0,0 +1,18 @@
+{#
+SPDX-FileCopyrightText: 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com>
+
+SPDX-License-Identifier: AGPL-3.0-or-later
+#}
+
+{% if grains['nodename'] == 'dom0' -%}
+
+"{{ slsdotpath }}-port-forward-script":
+  file.managed:
+    - name: /usr/local/bin/qvm-port-forward
+    - source: salt://{{ slsdotpath }}/files/bin/qvm-port-forward
+    - mode: "0755"
+    - user: root
+    - group: root
+    - makedirs: True
+
+{% endif -%}
diff --git a/salt/dom0/port-forward.top b/salt/dom0/port-forward.top
new file mode 100644
index 0000000..578ace6
--- /dev/null
+++ b/salt/dom0/port-forward.top
@@ -0,0 +1,10 @@
+{#
+SPDX-FileCopyrightText: 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com>
+
+SPDX-License-Identifier: AGPL-3.0-or-later
+#}
+
+base:
+  'dom0':
+    - match: nodegroup
+    - dom0.port-forward
diff --git a/salt/sys-syncthing/create.sls b/salt/sys-syncthing/create.sls
index 0a5a81e..7ee30b0 100644
--- a/salt/sys-syncthing/create.sls
+++ b/salt/sys-syncthing/create.sls
@@ -10,6 +10,7 @@ SPDX-License-Identifier: AGPL-3.0-or-later
 include:
   - .clone
   - browser.create
+  - dom0.port-forward
 
 {% load_yaml as defaults -%}
 name: tpl-{{ slsdotpath }}
@@ -100,12 +101,3 @@ features:
 
 {% from 'utils/macros/policy.sls' import policy_set with context -%}
 {{ policy_set(sls_path, '80') }}
-
-"{{ slsdotpath }}-qvm-port-forward":
-  file.managed:
-    - name: /usr/local/bin/qvm-port-forward
-    - source: salt://{{ slsdotpath }}/files/admin/firewall/qvm-port-forward
-    - user: root
-    - group: root
-    - mode: '0755'
-    - makedirs: True