# Let's Encrypt and Firewall rules

**URL:** <https://community.letsencrypt.org/t/lets-encrypt-and-firewall-rules/18641>\
**Category:** Server\
**Created:** [August 5, 2016, 1:44pm UTC](https://community.letsencrypt.org/t/lets-encrypt-and-firewall-rules/18641 "2016-08-05T13:44:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dtux](https://avatars.discourse-cdn.com/v4/letter/d/7feea3/32.png) [@Dtux](https://community.letsencrypt.org/u/Dtux)\
**Post date:** [August 5, 2016, 1:44pm UTC](https://community.letsencrypt.org/t/lets-encrypt-and-firewall-rules/18641/1 "2016-08-05T13:44:09Z")

</div>

Hello,  
I would need some help about allowing let’s encrypt to work properly on my server. I had to allow All incoming trafic and all outgoing trafic in order to make the issuance of my cert.

But i would like to drop back all default trafic so what do I need to allow in IPTABLES in order to let certbot works (i did the automated install).

Thanks

---

<div class="post-metadata">

**Author:** ![pfg](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/pfg/32/1924_2.png) [@pfg](https://community.letsencrypt.org/u/pfg)\
**Post date:** [August 5, 2016, 2:23pm UTC](https://community.letsencrypt.org/t/lets-encrypt-and-firewall-rules/18641/2 "2016-08-05T14:23:54Z")

</div>

I have not done any tests to confirm this, but here’s what I _think_ ought to be the the minimum set of firewall rules you need for Let’s Encrypt:

- For all challenge types: Allow outgoing traffic to `acme-v01.api.letsencrypt.org` on port 443 (HTTPS).
- For `HTTP-01` (for example via `certbot`'s webroot plugin): Allow incoming traffic on port 80 (HTTP) from _anywhere_.
- For `TLS-SNI-01` (for example via `certbot`'s standalone or apache plugin - this is probably what you used, if I’m interpreting “automated install” correctly): Allow incoming traffic on port 443 (HTTPS) from _anywhere_.

In case you’re wondering why it’s “anywhere” for `HTTP-01` and `TLS-SNI-01`, and not a set of specific IPs: Let’s Encrypt plans to perform validation requests from a number of (possibly) unpredictable IP addresses in the future, in order to make spoofing validation requests harder. If you rely on a specific IP address being used, your deployment will break without any warning at some point.

If you’re looking for a challenge type that does not require allowing _any_ incoming traffic, take a look at `DNS-01`. With that challenge type, domain ownership is demonstrated via a TXT record you create for your domain. Note that this is currently not supported by `certbot`, you’d have to use one of the [alternative clients](https://letsencrypt.org/docs/client-options/) (take a look at lego or any of the bash clients).

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [September 4, 2016, 2:24pm UTC](https://community.letsencrypt.org/t/lets-encrypt-and-firewall-rules/18641/3 "2016-09-04T14:24:16Z")

</div>

Closed on September 4, 2016, 2:24pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.