Hi @roosit,
We've had a number of threads on this forum related to different aspects of this, but per
and this very recent thread
Let's Encrypt isn't willing to commit to connecting or not connecting from any particular part of the Internet, or otherwise support people making firewall exceptions specifically for Let's Encrypt IP addresses. If there are any IP addresses from which you don't want to allow inbound challenge connections, we request that you use the DNS-01 challenge method.