# Deploy Streamlit App behind Firewall on AWS EC2

**URL:** <https://discuss.streamlit.io/t/deploy-streamlit-app-behind-firewall-on-aws-ec2/86626>\
**Category:** Deployment\
**Tags:** discussion\
**Created:** [November 27, 2024, 6:49pm UTC](https://discuss.streamlit.io/t/deploy-streamlit-app-behind-firewall-on-aws-ec2/86626 "2024-11-27T18:49:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tcup](https://sea2.discourse-cdn.com/streamlit/user_avatar/discuss.streamlit.io/tcup/32/51695_2.png) [@tcup](https://discuss.streamlit.io/u/tcup)\
**Post date:** [November 27, 2024, 6:49pm UTC](https://discuss.streamlit.io/t/deploy-streamlit-app-behind-firewall-on-aws-ec2/86626/1 "2024-11-27T18:49:43Z")

</div>

Hi,

I’m trying to deploy an app on an EC2 instance thats behind a firewall, where only people on the company network/vpn can access it. Is this possible? I’m less familiar with networking so I’m not too sure how this can work if streamlit is supposed to be deployed on port 8501, which is what i’ve been seeing in most articles

---

<div class="post-metadata">

**Author:** ![Encrypt](https://sea2.discourse-cdn.com/streamlit/user_avatar/discuss.streamlit.io/encrypt/32/52088_2.png) [@Encrypt](https://discuss.streamlit.io/u/Encrypt)\
**Post date:** [November 28, 2024, 12:05pm UTC](https://discuss.streamlit.io/t/deploy-streamlit-app-behind-firewall-on-aws-ec2/86626/2 "2024-11-28T12:05:56Z")

</div>

Yes, you can do it. You need to bind it to the internal IP address of the EC2 instance, not the public IP. You can do this by creating the `~/.streamlit/config.toml` file and adding the following:

```toml
[server]
headless = true
enableCORS = false
address = "0.0.0.0" # Listens on all available interfaces
port = 8501

```

Subsequently, you must implement firewall rules by navigating to the Security Groups of your EC2 instance within the AWS Management Console. Verify that the Security Group permits inbound traffic exclusively from your company’s internal network or VPN.

If you require more advanced routing capabilities or wish to enhance the application’s security through HTTPS, you can utilize an internal load balancer or reverse proxy to redirect requests to your Streamlit application running on port 8501.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/streamlit/original/3X/c/f/cf4c2ee0d938358f82448c5fe4b9c3c91d7ce19c.svg) [@system](https://discuss.streamlit.io/u/system)\
**Post date:** [May 27, 2025, 12:06pm UTC](https://discuss.streamlit.io/t/deploy-streamlit-app-behind-firewall-on-aws-ec2/86626/3 "2025-05-27T12:06:19Z")

</div>

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.