Skip to content
homeport

Web-ingress firewall

Running behind an edge proxy only helps if attackers can’t skip it: your origin IP is usually in public DNS history. The real protection is a kernel-level firewall that only accepts web traffic from the edge’s IP ranges.

Terminal window
homeport server firewall allow cloudflare  # fetch CF's live ranges → 80/443 only from Cloudflare
homeport server firewall                    # show the current policy
homeport server firewall clear              # reopen to the world

allow cloudflare pulls Cloudflare’s current edge ranges (v4 + v6) and applies them — no list to paste or keep up to date. For any other edge (or a custom allow-list), pass a file or - for stdin — a declarative CIDR list (one per line, # comments) that replaces the previous policy wholesale:

Terminal window
curl -s https://api.fastly.com/public-ip-list | jq -r '.addresses[]' > edge.txt
homeport server firewall allow edge.txt

Rules are swapped with no gap, enforced by the kernel (dropped before a TCP handshake — no per-request checks anywhere), and SSH is never touched, so a bad policy can only break web traffic, not lock you out.