diff --git a/conf.d/adguardhome.conf.template b/conf.d/adguardhome.conf.template
index ce99cad..c46ecd9 100644
--- a/conf.d/adguardhome.conf.template
+++ b/conf.d/adguardhome.conf.template
@@ -5,6 +5,7 @@ server {
     server_name adguard.${BASE_DOMAIN};
 
     include snippets/proxy.conf;
+    include snippets/internal-only.conf;
 
     location / {
         proxy_pass http://adguardhome;
diff --git a/conf.d/backrest.conf.template b/conf.d/backrest.conf.template
index 3b1bd7c..e557460 100644
--- a/conf.d/backrest.conf.template
+++ b/conf.d/backrest.conf.template
@@ -5,6 +5,7 @@ server {
     server_name backrest.${BASE_DOMAIN};
 
     include snippets/proxy.conf;
+    include snippets/internal-only.conf;
 
     location / {
         proxy_pass http://backrest:9898;
diff --git a/conf.d/qbittorrent.conf.template b/conf.d/qbittorrent.conf.template
index 5b52f6d..bddc427 100644
--- a/conf.d/qbittorrent.conf.template
+++ b/conf.d/qbittorrent.conf.template
@@ -5,6 +5,7 @@ server {
     server_name qbt.${BASE_DOMAIN};
 
     include snippets/proxy.conf;
+    include snippets/internal-only.conf;
 
     location / {
         proxy_pass http://qbittorrent:8080;
diff --git a/snippets/internal-only.conf.template b/snippets/internal-only.conf.template
new file mode 100644
index 0000000..232b40d
--- /dev/null
+++ b/snippets/internal-only.conf.template
@@ -0,0 +1,2 @@
+allow 192.168.10.0/24;
+deny all;