--- title: "Firewall and internal server configuration for Flow" canonical: "https://support.appfire.com/space/FD/1802469405/Firewall%20and%20internal%20server%20configuration%20for%20Flow" format: markdown --- > Macro (aura-html) Many customers host their Git repositories or ticket projects on internal servers using GitHub Enterprise, GitLab, Bitbucket Server, Jira, or similar products. Flow needs to access these servers in order to collect the data used to calculate your metrics.  You can securely allow access via HTTPS to internal repositories. This ensures that all data transmitted to Flow uses a secure protocol. > 📝 To receive emails from Flow, you’ll need to allowlist emails from the `appfireflow.com` domain. You’ll receive most emails from `no-reply@appfireflow.com`. ## Setup To make sure Flow can access your data, add Flow’s static IP addresses to your allowlist. > ℹ️ If you prefer to allowlist by domain instead of IP address, add `flow.pluralsight.com` and `appfireflow.com` to your allowlist. 1. Add Flow's static IP addresses to your allowlist: - 52.89.66.218 - 52.88.145.188 - 52.34.18.208 - 54.185.167.177 - 52.12.105.163 - 54.148.234.120 - 3.132.140.21 - 3.128.138.77 - 3.129.193.109 2. Open up a port on your network. 3. Once we have confirmed a secure connection with Flow, you may import your repos via one of our supported [vendors](https://appfire.atlassian.net/wiki/spaces/FD/pages/1802436913). > ℹ️ If you use an internal Git or ticketing server to integrate with Flow, ensure port 443 is open for Flow to connect to your instance to ingest git, PR, and ticket data. You may have an additional web application firewall (WAF). If so, allowlist these IPs for that firewall and adjust your WAF rate limits as needed. ## Connect Flow to self-hosted servers behind an API gateway or reverse proxy For Flow to ingest your data, your self-hosted git and ticket servers must be reachable via a public domain. This public domain is configured as your Base URL during integration setup. When Flow makes the initial connection with your git or ticket systems, it retrieves a list of available projects with their associated URLs. However, if your git or ticket servers sit behind a reverse proxy or API gateway, the returned project URLs will be associated with your private domain and not reachable by Flow. It requires additional configuration to properly map these internal URLs to your public domain.  This diagram outlines the steps our ingestion process follows and which URL domains Flow receives in response. ![A data ingestion diagram detailing the API calls Flow makes to ingest data with private domain, the response codes it receives in return, and the public and private domain URLs returned with each call. Step 1 is the credentials validation with 200 OK status. Step 2 is Flow's project discovery from the public domain with the vendor responding with private domain URLs. Step 3 is Flow's attempt to process data from those vendor URLs and receiving a DNS error in response.](media://539f73af-a702-4ecb-bc7f-09cf064fc475) If your git or ticket servers sit behind a reverse proxy or API gateway, please [reach out to your Flow contact](https://appfire.atlassian.net/wiki/spaces/FD/pages/1802272845) to provide the fully qualified domain name of your public domain. Flow will map the private domain retrieved from your integration to your public domain to transform the URLs to ingest data. This public domain should be in the form of either: - `public.domain.com` - `public.domain.com//` - `public.domain.com:` - `public.domain.com://` Once Flow maps your domains, your data may need to be ingested and processed again for the changes to take effect. > ℹ️ If you have a reverse proxy limiting the size of outgoing data, make sure the data limit is set to be larger than your largest repo so Flow can correctly complete data ingestion.