diff --git a/files/iptables/iptables b/files/iptables/iptables
index 137fef7362..4c1e26fb1d 100644
--- a/files/iptables/iptables
+++ b/files/iptables/iptables
@@ -17,6 +17,11 @@
 # allow ssh - always
 -A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 22 -j ACCEPT
 
+# for fireball mode - allow port 5099 from lockbox and it's ips
+-A INPUT -p tcp -m tcp --dport 5099 -s 192.168.1.58 -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 5099 -s 10.5.126.23 -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 5099 -s 10.5.127.51 -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 5099 -s 209.132.181.6 -j ACCEPT
 
 # if the host/group defines incoming tcp_ports - allow them
 {% for port in tcp_ports %}