diff --git a/nixos/hosts/ingress-proxy/default.nix b/nixos/hosts/ingress-proxy/default.nix
index 2353be2..64faec4 100644
--- a/nixos/hosts/ingress-proxy/default.nix
+++ b/nixos/hosts/ingress-proxy/default.nix
@@ -111,13 +111,13 @@ in rec {
           proxyWebsockets = true;
         };
         extraConfig = ''
-          deny all;
           allow 127.0.0.1;
           allow 100.64.0.0/10;
           allow 10.0.0.0/8;
           allow 15.204.161.37; 
           allow 108.238.21.159; 
           allow 162.197.1.49;
+          deny all;
         '';
       } // defaultConfig;