# Restrict ingress traffic with IP allow-lists

The [Quick Start Guide]({{< ref "/product/compute/containers/quick-start/">}}) opens the NodePort range (`30000-32767`) to `0.0.0.0/0` so you can start exposing services right away. That rule is convenient, but it also means **any host on the internet can reach any NodePort on your cluster**, including services you may not have intended to publish.

This guide replaces that single open rule with two narrower ones, so traffic is only allowed from a restricted set of sources:

| Source                              | Why it needs access                                                                 |
|--------------------------------------|---------------------------------------------------------------------------------------|
| Your known IP address(es)            | Lets you and your team reach NodePort services directly, e.g. for testing.            |
| Exoscale's NLB health-check sources  | Required if you front your NodePort services with a [Network Load Balancer]({{< ref "/product/networking/nlb/">}}), so it can perform health checks. |

Everything else on the internet is denied by default, which significantly reduces the attack surface of your cluster.

## Replace the open NodePort rule

You need to change this rule:

```bash
exo compute security-group rule add sks-security-group \
    --description "NodePort services" \
    --protocol tcp \
    --network 0.0.0.0/0 \
    --port 30000-32767
```

and replace it by the two rules below.

### 1. Allow NodePort traffic from your own IP

```bash
exo compute security-group rule add sks-security-group \
    --description "NodePort TCP services from Internet" \
    --protocol tcp \
    --network x.x.x.x/32 \
    --port 30000-32767
```

> [!NOTE]
> Replace `x.x.x.x/32` with an IP range that should be allowed to reach your service (your workstation, office egress IP, a monitoring probe, etc). Add as many rules as you have ranges to allow.

### 2. Allow NodePort traffic from the NLB health checks

```bash
exo compute security-group rule add sks-security-group \
    --description "Nodeport TCP services from NLB" \
    --protocol tcp \
    --port 30000-32767 \
    --public-security-group "public-nlb-healthcheck-sources"
```

## Terraform

If you manage your infrastructure as code, the same two rules translate to:

```hcl
resource "exoscale_security_group_rule" "nodeport_tcp_nlb" {
  security_group_id     = exoscale_security_group.my_sks_security_group.id
  description            = "Nodeport TCP service from NLB"
  type                   = "INGRESS"
  protocol               = "TCP"
  start_port             = 30000
  end_port               = 32767
  public_security_group  = "public-nlb-healthcheck-sources"
}

resource "exoscale_security_group_rule" "nodeport_service_mylaptop" {
  security_group_id = exoscale_security_group.my_sks_security_group.id
  description        = "NodePort services from a known IP"
  type               = "INGRESS"
  protocol           = "TCP"
  start_port         = 30000
  end_port           = 32767
  cidr               = "x.x.x.x/32"
}
```

> [!NOTE]
> Replace `x.x.x.x/32` with the IP address that should be allowed to reach your service.

## See Also

* A breakdown of [Exoscale Security Groups]({{< ref "product/networking/security-group/">}})