# HAProxy, LE Challenge, Firewall Rule

**URL:** <https://community.ipfire.org/t/haproxy-le-challenge-firewall-rule/12031>\
**Category:** Network\
**Created:** [30 August 2024 06:07 UTC](https://community.ipfire.org/t/haproxy-le-challenge-firewall-rule/12031 "2024-08-30T06:07:36Z")\
**Posts on this page:** 1\
**Showing post:** 9

<div class="post-metadata">

**Author:** ![hellfire](https://community.ipfire.org/user_avatar/community.ipfire.org/hellfire/32/8454_2.png) [@hellfire](https://community.ipfire.org/u/hellfire)\
**Post date:** [31 August 2024 18:09 UTC](https://community.ipfire.org/t/haproxy-le-challenge-firewall-rule/12031/9 "2024-08-31T18:09:52Z")

</div>

> [@bonnietwin](#):
>
> Maybe you could have the location blocking in place and only disable it in the time frame when you need the LE update to occur.

That would be perfect, honestly I have done this before, using some commands in my renewing shell script, but unfortunately they now fail since IPFire uses a different location blocking mechanism.

And to be fair, LE used just US servers before and I had to unblock a single country. Now, LE uses many countries as their origin which we do not know (you just gave the link above, thanks for this, Adolf)

So, I could imagine to stop all location block while renewing starts and acivate the blocks immediately afterwards. This would include, restarting the firewall, too, as it is necessary in WebIF.

However, I don’t know the exact commands to stop location blocks, restart the firewall and vice versa.

_EDIT_: I assume, the firewall is running **before** HAProxy, correct. Otherwise, the location block would be obsolet, correct?  
This is why I will need a firewall rule to allow incoming traffic on RED to be forwarded to IPFire itself?

---

_[View the full topic](https://community.ipfire.org/t/haproxy-le-challenge-firewall-rule/12031)._