Disclaimer: I don't have in-depth knowledge of networking, so please pardon me if my question doesn't make sense at some places.

I wish to make my Pi a web server on the internet and restrict access to it. The server part is completed and it can be used on the internet (although I haven't started the service or connected the Pi to the internet). However, I am unable to figure out a major security aspect of it all - how to allow only selected IP addresses to connect to it?

The server is meant to be used only by family and friends, so the number of allowable IP addresses is not many. Is there a way I can say to the Pi "hey, allow only these IPs. Ignore every other connection"?

I've checked out UFW but I'm not sure if that is the right option for my case. I always have physical access to the Pi, so I plan to block/disable SSH port completely and allow only 8080 (http) as my server (ngrok based) uses that.

Please advice on what I can do.

  • This has NOTHING to do with the Pi. It is configured in your router. "The server part is completed and it can be used on the internet" so your system is already compromised. The ONLY secure method is VPN.
    – Milliways
    Nov 20, 2021 at 10:35
  • I would still consider using UFW, it sits above any webserver IP blocking and will really make sure only selected IP addresses can connect on only the ports you want to open. As Dmitry says though that's no guarantee the allowed IP is legit so have a login step too.
    – Paul
    Nov 21, 2021 at 3:48

1 Answer 1


Check the documentation of your web server. In Apache, this is done with mod_authz_core:

Require ip <list of addresses>

Before proceeding, check that all your friends actually have static public IP addresses which you could list. Most people have dynamic IPs which change a couple of times a day, making your approach incredibly hard to maintain.

Not to mention that it's pretty bad from the security perspective - you plan to rely on how well your provider blocks traffic with fake IP addresses. And of course your provider's malicious employee would be able to access your website just fine.

Just do that everyone else does: create users with names and passwords, and make sure your server asks for a password before delivering the content. This is easily done if you install a content management system such as Nextcloud or Wordpress.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.