# Defensive configurability in Fly Proxy?

**URL:** <https://community.fly.io/t/defensive-configurability-in-fly-proxy/28988>\
**Category:** Questions / Help\
**Tags:** security, proxy\
**Created:** [November 3, 2026, 10:39pm UTC](https://community.fly.io/t/defensive-configurability-in-fly-proxy/28988 "2026-11-03T22:39:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![megahall](https://avatars.discourse-cdn.com/v4/letter/m/b3f665/32.png) [@megahall](https://community.fly.io/u/megahall)\
**Post date:** [November 3, 2026, 10:39pm UTC](https://community.fly.io/t/defensive-configurability-in-fly-proxy/28988/1 "2026-11-03T22:39:45Z")

</div>

I wanted to follow up on this reply from @PeterCxy :

> [@How to securely put a Fly.io app behind a WAF (tunnel vs allowlist?)](https://community.fly.io/t/how-to-securely-put-a-fly-io-app-behind-a-waf-tunnel-vs-allowlist/26532/3):
>
> Your app should parse the X-Forwarded-For header and allow only clients from trusted reverse proxies (a WAF is a reverse proxy). Most application frameworks should allow you to do that with minimal added code and you shouldn’t need yet another reverse proxy in front. DDoS is not a direct concern (for you) since Fly Proxy terminates the TCP connections, so any DDoS traffic is going to hit Fly Proxy first. If they do not establish a real TCP connection, then that attack ends at us, not your machi…

We run an app that has some public ports, and some private management ports. We’d like to be able to restrict certain ports to specific IPv4 and IPv6 CIDRs at the Fly Proxy, to prevent forwarding connections to a Machine.

Currently, we enforce this manually in our app using the PROXY protocol. Are there existing features or previews that could help? Are there any updates support “programming” the proxy as of yet?

We would love to see native support such things in fly.toml, perhaps something like:

```auto
[[services]]
  protocol = "tcp"
  internal_port = 1081

  [[services.ports]]
    port = 8443
    handlers = ["proxy_proto"]

    [services.ports.ingress_acl]
      default_action = "deny"
      cidrs = [
        "198.51.100.0/24",
        "2001:db8:1234::/48",
      ]

```

---

<div class="post-metadata">

**Author:** ![PeterCxy](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/petercxy/32/36155_2.png) [@PeterCxy](https://community.fly.io/u/PeterCxy)\
**Post date:** [November 4, 2026, 2:41pm UTC](https://community.fly.io/t/defensive-configurability-in-fly-proxy/28988/2 "2026-11-04T14:41:44Z")

</div>

Yes, I could see this to be something that would definitely be helpful, but currently we cannot provide a definite answer to if/when we will add this sort of capabilities to the proxy. I will say that something like this has been discussed internally as well.