diff --git a/manifests/firewall/iptables.pp b/manifests/firewall/iptables.pp
index 682689f..2ad0553 100644
--- a/manifests/firewall/iptables.pp
+++ b/manifests/firewall/iptables.pp
@@ -18,5 +18,13 @@ class confdroid_haproxy::firewall::iptables (
       dport => $hy_https_port,
       jump  => 'accept',
     }
+
+    if $hy_show_stats == true {
+      firewall { "${hy_fw_order_no}${hy_stats_port} tcp port ${hy_stats_port}":
+        proto => 'tcp',
+        dport => $hy_stats_port,
+        jump  => 'accept',
+      }
+    }
   }
 }
diff --git a/manifests/params.pp b/manifests/params.pp
index deb58c6..f77bde4 100644
--- a/manifests/params.pp
+++ b/manifests/params.pp
@@ -55,6 +55,7 @@
 # @param [String] hy_be_userlist backend userlist comment
 # @param [Boolean] hy_manage_be_users  whether to manage backend users
 # @param [Boolean] hy_selinux_allow_stats whether to allow stats in selinux
+# @param [String] hy_stats_port the port to use for stats. used in firewall settings
 ###############################################################################
 class confdroid_haproxy::params (
 
@@ -76,6 +77,7 @@ class confdroid_haproxy::params (
 # main config
   String $hy_http_port                = '80',
   String $hy_https_port               = '443',
+  String $hy_stats_port               = '8404',
   String $hy_chroot                   = '/var/lib/haproxy',
   String $hy_pid                      = '/var/run/haproxy.pid',
   String $hy_maxconn                  = '4000',