---
title: "Web-ingress firewall"
description: "Lock 80/443 to an edge's IP ranges so attackers can't bypass the proxy — SSH untouched."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.homeport.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Web-ingress firewall

Running behind an edge proxy only helps if attackers can't skip it: your origin
IP is usually in public DNS history. The real protection is a kernel-level
firewall that only accepts web traffic **from the edge's IP ranges**.

```sh
homeport server firewall allow cloudflare  # fetch CF's live ranges → 80/443 only from Cloudflare
homeport server firewall                    # show the current policy
homeport server firewall clear              # reopen to the world
```

`allow cloudflare` pulls Cloudflare's [current edge ranges](https://www.cloudflare.com/ips/)
(v4 + v6) and applies them — no list to paste or keep up to date. For any other
edge (or a custom allow-list), pass a file or `-` for stdin — a declarative CIDR
list (one per line, `#` comments) that replaces the previous policy wholesale:

```sh
curl -s https://api.fastly.com/public-ip-list | jq -r '.addresses[]' > edge.txt
homeport server firewall allow edge.txt
```

Rules are swapped with no gap, enforced by the kernel (dropped before a TCP
handshake — no per-request checks anywhere), and **SSH is never touched**, so a
bad policy can only break web traffic, not lock you out.

> **Pair it with DNS-01 or a manual cert**
>
> Once the box only accepts edge traffic, Let's Encrypt can't reach it over
> HTTP-01. Use `tls: manual` (BYO cert) or `tls: dns:<provider>` /
> `cloudflare: true` (DNS-01, proven over the DNS API). homeport warns about any
> app still on plain automatic HTTPS, and leaves `manual` / `dns:` apps alone.

Source: https://docs.homeport.sh/guides/web-firewall/index.mdx