diff --git a/sshuttle/firewall.py b/sshuttle/firewall.py
index 0e060e2..b184d9b 100644
--- a/sshuttle/firewall.py
+++ b/sshuttle/firewall.py
@@ -51,7 +51,7 @@ def rewrite_etc_hosts(hostmap, port):
         os.chmod(tmpname, st.st_mode)
     else:
         os.chown(tmpname, 0, 0)
-        os.chmod(tmpname, 0o600)
+        os.chmod(tmpname, 0o644)
     try:
         os.rename(tmpname, HOSTSFILE)
     except OSError: