Since my Allsky camera is publicly available via Apache, secured with Let’s Encrypt and its own subdomain, I also wanted to harden the Raspberry Pi a little at network level – without risky experiments or unnecessary complexity. NAT provides basic protection for IPv4, but ports 80 and 443 in particular are publicly accessible. In addition, bots, scanners and automated requests generate unnecessary traffic.
My goal: a pragmatic firewall that allows real access, reduces bot noise and does not interfere with Let’s Encrypt. Here is the IPv4 part first – you can find an additional post about IPv6 here!