diff --git a/inventory/host_vars/qa07.qa.fedoraproject.org b/inventory/host_vars/qa07.qa.fedoraproject.org
index 4c6ecae8af..398d0f1ef1 100644
--- a/inventory/host_vars/qa07.qa.fedoraproject.org
+++ b/inventory/host_vars/qa07.qa.fedoraproject.org
@@ -5,3 +5,10 @@ eth0_ip: 10.5.124.157
 gw: 10.5.124.254
 # this interface is plugged in but we don't want or need it
 ansible_ifcfg_disabled: ['eth1']
+
+# firewall ports for server->worker websockets connections
+# this port is 'QEMUPORT plus 1'
+# QEMUPORT is:
+# $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002;
+# so for worker 1 it's 20012, for worker 2 it's 20022, etc etc
+tcp_ports: ['20013', '20023', '20033', '20043']
diff --git a/inventory/host_vars/qa09.qa.fedoraproject.org b/inventory/host_vars/qa09.qa.fedoraproject.org
index f69992ed4e..8a6ac1d5d4 100644
--- a/inventory/host_vars/qa09.qa.fedoraproject.org
+++ b/inventory/host_vars/qa09.qa.fedoraproject.org
@@ -16,3 +16,9 @@ ansible_ifcfg_whitelist: ['eth0']
 
 # this is a powerful machine, can handle more openQA workers
 openqa_workers: 10
+# firewall ports for server->worker websockets connections
+# this port is 'QEMUPORT plus 1'
+# QEMUPORT is:
+# $ENV{QEMUPORT} = ($options{instance}) * 10 + 20002;
+# so for worker 1 it's 20012, for worker 2 it's 20022, etc etc
+tcp_ports: ['20013', '20023', '20033', '20043', '20053', '20063', '20073', '20083', '20093', '20103']