diff --git a/AppDir/etc/daemon.yml b/AppDir/etc/daemon.yml
index 6674677..9456c10 100644
--- a/AppDir/etc/daemon.yml
+++ b/AppDir/etc/daemon.yml
@@ -66,11 +66,18 @@ storage:
   #
   # The ports are all required and must all be unique within and across
   # allocations.
+  #
+  # THe ports are all _optional_, and will be automatically assigned if they are
+  # not specified. If ports any ports are specified then all should be
+  # specified, and each should be unique across all allocations.
+  #
+  # Once assigned (either implicitly or explicitly) the rpc_port of an
+  # allocation should not be changed.
   allocations:
 
     #- data_path: /foo/bar/data
     #  meta_path: /foo/bar/meta
     #  capacity: 1200
-    #  s3_api_port: 3900
-    #  rpc_port:    3901
-    #  admin_port:  3902
+    #  #s3_api_port: 3900
+    #  #rpc_port:    3901
+    #  #admin_port:  3902
diff --git a/entrypoint/src/cmd/entrypoint/nebula_util.go b/entrypoint/src/cmd/entrypoint/nebula_util.go
index c6737dc..d0f5e8d 100644
--- a/entrypoint/src/cmd/entrypoint/nebula_util.go
+++ b/entrypoint/src/cmd/entrypoint/nebula_util.go
@@ -7,7 +7,6 @@ import (
 	"fmt"
 	"net"
 	"path/filepath"
-	"strconv"
 
 	"code.betamike.com/cryptic-io/pmux/pmuxlib"
 )
@@ -36,6 +35,8 @@ func waitForNebula(ctx context.Context, env crypticnet.Env) error {
 
 func nebulaPmuxProcConfig(env crypticnet.Env) (pmuxlib.ProcessConfig, error) {
 
+	thisDaemon := env.ThisDaemon()
+
 	var (
 		lighthouseHostIPs []string
 		staticHostMap     = map[string][]string{}
@@ -63,8 +64,9 @@ func nebulaPmuxProcConfig(env crypticnet.Env) (pmuxlib.ProcessConfig, error) {
 			"respond": true,
 		},
 		"tun": map[string]interface{}{
-			"dev": "cryptic-nebula1",
+			"dev": "cryptic-net-nebula",
 		},
+		"firewall": thisDaemon.VPN.Firewall,
 	}
 
 	if publicAddr := env.ThisDaemon().VPN.PublicAddr; publicAddr == "" {
@@ -97,32 +99,6 @@ func nebulaPmuxProcConfig(env crypticnet.Env) (pmuxlib.ProcessConfig, error) {
 		}
 	}
 
-	thisDaemon := env.ThisDaemon()
-
-	var firewallInbound []crypticnet.ConfigFirewallRule
-
-	for _, alloc := range thisDaemon.Storage.Allocations {
-		firewallInbound = append(
-			firewallInbound,
-			crypticnet.ConfigFirewallRule{
-				Port:  strconv.Itoa(alloc.S3APIPort),
-				Proto: "tcp",
-				Host:  "any",
-			},
-			crypticnet.ConfigFirewallRule{
-				Port:  strconv.Itoa(alloc.RPCPort),
-				Proto: "tcp",
-				Host:  "any",
-			},
-		)
-	}
-
-	firewall := thisDaemon.VPN.Firewall
-
-	firewall.Inbound = append(firewallInbound, firewall.Inbound...)
-
-	config["firewall"] = firewall
-
 	nebulaYmlPath := filepath.Join(env.RuntimeDirPath, "nebula.yml")
 
 	if err := yamlutil.WriteYamlFile(config, nebulaYmlPath); err != nil {
diff --git a/entrypoint/src/daemon_yml.go b/entrypoint/src/daemon_yml.go
index 15241be..a8275ab 100644
--- a/entrypoint/src/daemon_yml.go
+++ b/entrypoint/src/daemon_yml.go
@@ -1,5 +1,7 @@
 package crypticnet
 
+import "strconv"
+
 type ConfigFirewall struct {
 	Conntrack ConfigConntrack      `yaml:"conntrack"`
 	Outbound  []ConfigFirewallRule `yaml:"outbound"`
@@ -49,3 +51,45 @@ type DaemonYml struct {
 		Allocations []DaemonYmlStorageAllocation
 	} `yaml:"storage"`
 }
+
+// FillDefaults fills in default values in the DaemonYml.
+func (d *DaemonYml) FillDefaults() {
+
+	var firewallGarageInbound []ConfigFirewallRule
+
+	for i := range d.Storage.Allocations {
+
+		if d.Storage.Allocations[i].RPCPort == 0 {
+			d.Storage.Allocations[i].RPCPort = 3900 + (i * 10)
+		}
+
+		if d.Storage.Allocations[i].S3APIPort == 0 {
+			d.Storage.Allocations[i].S3APIPort = 3901 + (i * 10)
+		}
+
+		if d.Storage.Allocations[i].AdminPort == 0 {
+			d.Storage.Allocations[i].AdminPort = 3902 + (i * 10)
+		}
+
+		alloc := d.Storage.Allocations[i]
+
+		firewallGarageInbound = append(
+			firewallGarageInbound,
+			ConfigFirewallRule{
+				Port:  strconv.Itoa(alloc.S3APIPort),
+				Proto: "tcp",
+				Host:  "any",
+			},
+			ConfigFirewallRule{
+				Port:  strconv.Itoa(alloc.RPCPort),
+				Proto: "tcp",
+				Host:  "any",
+			},
+		)
+	}
+
+	d.VPN.Firewall.Inbound = append(
+		d.VPN.Firewall.Inbound,
+		firewallGarageInbound...,
+	)
+}
diff --git a/entrypoint/src/env.go b/entrypoint/src/env.go
index d57b8b8..cc8d34e 100644
--- a/entrypoint/src/env.go
+++ b/entrypoint/src/env.go
@@ -215,6 +215,8 @@ func (e Env) ThisDaemon() DaemonYml {
 		if err := yamlutil.LoadYamlFile(&e.thisDaemon, e.DaemonYmlPath); err != nil {
 			panic(err)
 		}
+
+		e.thisDaemon.FillDefaults()
 	})
 	return e.thisDaemon
 }