diff --git a/deploy/helm/wg-access-server/README.md b/deploy/helm/wg-access-server/README.md
index 8f8d7860..d82d43f2 100644
--- a/deploy/helm/wg-access-server/README.md
+++ b/deploy/helm/wg-access-server/README.md
@@ -62,8 +62,10 @@ ingress:
 |-----|------|---------|-------------|
 | config | object | `{}` | inline wg-access-server config (config.yaml) |
 | web.service.type | string | `"ClusterIP"` |  |
+| web.service.port | number | random | Port number if `web.service.type` is set to `NodePort` |
 | wireguard.config.privateKey | string | "" | A wireguard private key. You can generate one using `$ wg genkey` |
 | wireguard.service.type | string | `"ClusterIP"` |  |
+| wireguard.service.port | number | random | Port number if `wireguard.service.type` is set to `NodePort` |
 | ingress.enabled | bool | `false` |  |
 | ingress.hosts | string | `nil` |  |
 | ingress.tls | list | `[]` |  |
diff --git a/deploy/helm/wg-access-server/templates/service.yaml b/deploy/helm/wg-access-server/templates/service.yaml
index 6734eab7..4124ab77 100644
--- a/deploy/helm/wg-access-server/templates/service.yaml
+++ b/deploy/helm/wg-access-server/templates/service.yaml
@@ -19,6 +19,9 @@ spec:
 {{- end }}
   ports:
     - port: 80
+    {{- if and (eq .Values.web.service.type "NodePort") ( .Values.web.service.port ) }}
+      nodePort: {{ .Values.web.service.port }}
+    {{- end }}
       targetPort: 8000
       protocol: TCP
       name: http
@@ -48,6 +51,9 @@ spec:
 {{- end }}
   ports:
     - port: 51820
+    {{- if and (eq .Values.wireguard.service.type "NodePort") ( .Values.wireguard.service.port ) }}
+      nodePort: {{ .Values.wireguard.service.port }}
+    {{- end }}
       targetPort: 51820
       protocol: UDP
       name: wireguard
diff --git a/deploy/helm/wg-access-server/values.yaml b/deploy/helm/wg-access-server/values.yaml
index e54f5cad..5f4de404 100644
--- a/deploy/helm/wg-access-server/values.yaml
+++ b/deploy/helm/wg-access-server/values.yaml
@@ -7,12 +7,16 @@ web:
     adminPassword: ""
   service:
     type: ClusterIP
+    # type: NodePort
+    # port: 32548
 
 wireguard:
   config:
     privateKey: ""
   service:
     type: ClusterIP
+    # type: NodePort
+    # port: 30392
 
 persistence:
   enabled: false