Allow HotWall IP addresses

Get the current list of HotWall addresses and let only them reach your server.

Why allow only HotWall

Once a website is protected, visitors reach your server through HotWall: requests pass the firewall, then HotWall connects to your server from its own addresses. If the server also answers everyone else, an attacker who finds its IP skips the protection entirely.

Allow the web ports (usually 80 and 443) only from the addresses below and refuse the rest. Everything else on the server, such as SSH, keeps its own rules.

Get the current addresses

The list is public and needs no API key. It holds every A and AAAA record of hotwall.app, the addresses HotWall runs on, and is refreshed every 5 minutes.

Add ?format=text to get one address per line, ready for shell scripts. Use the list itself, not addresses copied from this page: they can change.

Shell

curl -fsS "https://dash.hotwall.app/api/v1/edge/ips"
{
  "hostname": "hotwall.app",
  "ipv4": ["51.254.208.172", "57.129.159.50"],
  "ipv6": [],
  "updated_at": "2026-09-29T09:05:43Z"
}

# One address per line, for scripts:
curl -fsS "https://dash.hotwall.app/api/v1/edge/ips?format=text"

Allow them in nginx

If you cannot change the server firewall, restrict access in the web server. The commands build an allow list followed by deny all, check the configuration and reload nginx.

Behind a load balancer, nginx sees the balancer's address instead: restrict at the balancer or its security group then.

nginx

# Build the list (stop if the request fails or returns nothing)
ips=$(curl -fsS --max-time 10 "https://dash.hotwall.app/api/v1/edge/ips?format=text") && [ -n "$ips" ] || exit 1
printf '%s\n' $ips | awk '{ print "allow " $1 ";" } END { print "deny all;" }' \
  > /etc/nginx/snippets/hotwall-allow.conf
nginx -t && nginx -s reload

# In every server { } block of the protected website:
include snippets/hotwall-allow.conf;

Allow them in the firewall

A firewall rule stops other traffic before it reaches any application. With ufw: keep SSH open first, allow the web ports from each HotWall address, then deny them for everyone else.

ufw applies the first matching rule. Delete older rules that open 80 or 443 to everyone (see ufw status numbered), otherwise they still let everyone in. In a cloud, add the same addresses to the security group as /32 (IPv4) and /128 (IPv6) entries.

ufw

# 1. Keep your own access first
sudo ufw allow OpenSSH

# 2. Web ports only from HotWall
ips=$(curl -fsS --max-time 10 "https://dash.hotwall.app/api/v1/edge/ips?format=text") && [ -n "$ips" ] || exit 1
for ip in $ips; do
  sudo ufw allow proto tcp from "$ip" to any port 80,443
done

# 3. Everyone else is refused
sudo ufw deny 80/tcp
sudo ufw deny 443/tcp
sudo ufw enable
sudo ufw status numbered

Keep the list up to date

Addresses change when HotWall adds or moves capacity. Sync them on a schedule instead of copying them once: the script below keeps an ipset in sync every hour and swaps it in one step, so the rules never see a half-built list.

The script stops if the request fails or the list comes back empty, so a network error never closes the server. Add the two iptables rules once after the first run and save them.

Shell

#!/bin/sh
# /etc/cron.hourly/hotwall-allowlist: HTTP(S) only from HotWall, kept in sync
set -eu
ips=$(curl -fsS --max-time 10 "https://dash.hotwall.app/api/v1/edge/ips?format=text")
[ -n "$ips" ] || exit 1   # never apply an empty list

for v in 4 6; do
  family=inet; [ $v = 6 ] && family=inet6
  ipset create hotwall$v hash:ip family $family -exist
  ipset create hotwall$v-new hash:ip family $family -exist
  ipset flush hotwall$v-new
done
for ip in $ips; do
  case "$ip" in *:*) ipset add hotwall6-new "$ip" ;; *) ipset add hotwall4-new "$ip" ;; esac
done
for v in 4 6; do
  ipset swap hotwall$v-new hotwall$v && ipset destroy hotwall$v-new
done

# Once, after the first run (then save them with iptables-persistent):
#   iptables  -I INPUT -p tcp -m multiport --dports 80,443 -j DROP
#   iptables  -I INPUT -p tcp -m multiport --dports 80,443 -m set --match-set hotwall4 src -j ACCEPT
#   ip6tables -I INPUT -p tcp -m multiport --dports 80,443 -j DROP
#   ip6tables -I INPUT -p tcp -m multiport --dports 80,443 -m set --match-set hotwall6 src -j ACCEPT

Check the result

From a network outside the list, a direct request to the server's IP should fail, while the website still opens through its domain. Test IPv4, IPv6 and every web port.

If the website stops opening, check that no rule above the allow list blocks HotWall and that the list was not empty when it was applied.

Websites & protection