diff --git a/caddy/iptables/iptables-caddy.sh b/caddy/iptables/iptables-caddy.sh
index c46a39c..85a42d1 100755
--- a/caddy/iptables/iptables-caddy.sh
+++ b/caddy/iptables/iptables-caddy.sh
@@ -20,8 +20,10 @@ iptables -P FORWARD DROP
 
 # allow any tcp traffic on local lan
 iptables -A OUTPUT -j ACCEPT -d $SUBNET.0/24 -p tcp -m state --state NEW,ESTABLISHED,RELATED
-# only allow input on 443
+# allow input both 443 and 80
+# NOTE: need 80 as well for letsencrypt dont disable idiot
 iptables -A INPUT  -j ACCEPT -d $SUBNET.0/24 -p tcp --dport 443 -m state --state NEW,ESTABLISHED,RELATED
+iptables -A INPUT  -j ACCEPT -d $SUBNET.0/24 -p tcp --dport 80  -m state --state NEW,ESTABLISHED,RELATED
 # ========================================================================
 
 # dns to pihole