# Help on firewall **URL:** \ **Category:** Help\ **Created:** [April 22, 2021, 3:39pm UTC](https://community.letsencrypt.org/t/help-on-firewall/150257 "2021-04-22T15:39:12Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![bitcompany](https://avatars.discourse-cdn.com/v4/letter/b/ccd318/32.png) [@bitcompany](https://community.letsencrypt.org/u/bitcompany)\ **Post date:** [April 22, 2021, 3:39pm UTC](https://community.letsencrypt.org/t/help-on-firewall/150257/1 "2021-04-22T15:39:12Z")
Hello, my firewall is blocking let's encrypt renewals ... which IP address / port should I leave open? I do not put all the details of the site or the server, because they certainly do not serve to give me an answer, in any case if you want them anyway, just tell me ... the server hosts 246 domains ... I list them all? because it all happens to me, since the firewall is upstream 😃 ---
**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\ **Post date:** [April 22, 2021, 3:53pm UTC](https://community.letsencrypt.org/t/help-on-firewall/150257/2 "2021-04-22T15:53:39Z")
Are you having trouble with 1. Outbound of your servers being able to connect to the Let's Encrypt API?, or 2. Inbound of Let's Encrypt not being able to validate your ownership of the names? If 1, you need to have the firewall open to `https://acme-v02.api.letsencrypt.org` (which may not stay at the same IP). If 2, you need to have the firewall open from everybody [to your port 80](https://letsencrypt.org/docs/allow-port-80/) if you want to do an HTTP-01 request. (If you do a DNS-01 request, then the firewall has to be open from everybody to your DNS server on port 53, which some people find their security team prefer.) ---
**Author:** ![bitcompany](https://avatars.discourse-cdn.com/v4/letter/b/ccd318/32.png) [@bitcompany](https://community.letsencrypt.org/u/bitcompany)\ **Post date:** [April 22, 2021, 4:22pm UTC](https://community.letsencrypt.org/t/help-on-firewall/150257/3 "2021-04-22T16:22:13Z")
Thanks for the reply. I don't really know. I just know that she was renewing a certificate in a domain and told me that the DNS server was unreachable, so she couldn't proceed with the renewal. I disconnected the firewall and was able to renew. The firewall is now enabled, but renewals usually go smoothly. Evidently today an IP address was searched that my firewall is blocking. to know what they are what should I do? ok that are many, but to know them I could put them all in the firewall and avoid future stops ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [April 22, 2021, 4:22pm UTC](https://community.letsencrypt.org/t/help-on-firewall/150257/4 "2021-04-22T16:22:19Z")
And if you want to know if you can have a list of IP addresses used for validation by Let's Encrypt, so you can add them to your firewall, please see the FAQ (linked to exact question): > **[FAQ - Let's Encrypt](https://letsencrypt.org/docs/faq/#what-ip-addresses-does-let-s-encrypt-use-to-validate-my-web-server)** > > Last updated: Apr 23, 2020 | See all Documentation This FAQ is divided into the following sections: > General Questions Technical Questions General Questions What services does Let’s Encrypt offer? Let’s Encrypt is a global Certificate... ---
**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\ **Post date:** [April 22, 2021, 4:24pm UTC](https://community.letsencrypt.org/t/help-on-firewall/150257/5 "2021-04-22T16:24:47Z")
People here would need to know more details, about the domain, the command that was run, and the actual output in order to be able to really assist. If it was a problem reaching a DNS server, then it sounds like the firewall was blocking it, so you'd need to fix your firewall configuration to not block it. ---
**Author:** ![bitcompany](https://avatars.discourse-cdn.com/v4/letter/b/ccd318/32.png) [@bitcompany](https://community.letsencrypt.org/u/bitcompany)\ **Post date:** [April 22, 2021, 4:35pm UTC](https://community.letsencrypt.org/t/help-on-firewall/150257/6 "2021-04-22T16:35:22Z")
the domain is dmt.biz, it is reachable at the DNS level from all over the world and presents no problems. The firewall of the server that hosts it has blocked the renewal of the certificate. Now, not knowing which address the block was referring to, I can't not block it ... I have to enter an IP to tell you what not to block ... or remove the address that is in the list of blocked ones, only that to do that I need to know the address. As mentioned before, if the addresses vary, patience, it means that if it happens again, I will do as I did today: I turn off the firewall, proceed with the renewal, as soon as it is successful, turn the firewall back on. So I did and it's working. Thank you for your time. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [May 22, 2021, 4:35pm UTC](https://community.letsencrypt.org/t/help-on-firewall/150257/7 "2021-05-22T16:35:53Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.