---
title: "Configuring Firewall Rules in Private Networks | Hostman Docs"
description: "Set up correct firewall rules for DHCP in private networks to ensure stable IP assignment. Discover how to allow UDP traffic for inbound and outbound rules, configure gateway access, and avoid service connectivity issues."
---

> For the complete documentation index for AI agents, see [llms.txt](https://hostman.com/llms.txt).

When configuring firewall rules for services in private networks, you must correctly set up the rules required for DHCP, which provides services with their private IP address. If this is not configured, the service may lose its IP address after the lease expires, which can cause NAT issues and make the service inaccessible from the internet.

> [!NOTE]
> These settings are required if you have **allow rules** configured for services added to private networks.
>
> If rules are configured for both inbound and outbound traffic, you must apply both configurations.

## Rules Only for Inbound Traffic

If you have **rules created only for inbound traffic**, you need to allow inbound traffic to port 68/UDP from the gateway IP address of the private network where the service is located.

Example configuration:

![F725c24c 8a12 40cb 9e89 20731604f9d5](https://content.hostman.com/assets/8cbf9a17-ee54-4a00-a556-351e0efdbe22.png?width=482&height=863)

Replace `192.168.0.1` with the gateway address of your private network, or allow the entire private subnet (in this example `192.168.0.0/24`) or any addresses (`0.0.0.0/0`).

If services from different private networks with different gateway addresses are added to the same firewall group, you must create an allow rule for each gateway in the same way.

## Rules Only for Outbound Traffic

If rules are created **only for outbound traffic**, you need to allow outbound traffic to address `255.255.255.255` on port 67/UDP.

Example configuration:

![89517083 Cb33 4301 A024 De3fbdd11627](https://content.hostman.com/assets/a522251a-5361-45fd-a23e-ba5f8aa8f790.png?width=408&height=729)

Instead of `255.255.255.255`, you can also specify `0.0.0.0/0` to allow all addresses.