The way to connect Lets Encrypt when some of it's IPs are blocked by a FireWall

[rg305]

You can probably reduce the wide acceptance (--dports 80,443) to only HTTP (port 80).
[If the challenge files are being handled in HTTP - without HTTPS redirection.]