diff --git a/aws_cdk/lib/aws_cdk-stack.ts b/aws_cdk/lib/aws_cdk-stack.ts
index 393caae..2dcfc99 100644
--- a/aws_cdk/lib/aws_cdk-stack.ts
+++ b/aws_cdk/lib/aws_cdk-stack.ts
@@ -21,31 +21,22 @@ export class AwsCdkStack extends cdk.Stack {
     });
 
     // Allow SSH
-    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(22), 'Allow SSH access');
-
-    // Mail Protocols (SMTP, SMTPS, Submission)
-    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(25), 'Allow SMTP');
-    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(465), 'Allow SMTPS');
-    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(587), 'Allow SMTP Submission');
-
-    // Mail Protocols (IMAP, IMAPS)
-    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(143), 'Allow IMAP');
-    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(993), 'Allow IMAPS');
+    securityGroup.addIngressRule(ec2.Peer.ipv4('16.113.57.0/24'), ec2.Port.tcp(22), 'Allow SSH access');
 
     // Web Traffic (HTTP, HTTPS for Admin UI & Webmail / SSL certificates)
-    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(80), 'Allow HTTP');
-    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(443), 'Allow HTTPS');
+    securityGroup.addIngressRule(ec2.Peer.ipv4('16.113.57.0/24'), ec2.Port.tcp(80), 'Allow HTTP');
+    securityGroup.addIngressRule(ec2.Peer.ipv4('16.113.57.0/24'), ec2.Port.tcp(443), 'Allow HTTPS');
 
     // WireGuard VPN
     securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.udp(5010), 'Allow WireGuard VPN');
     securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(51821), 'Allow WireGuard Web UI');
 
     // Woodpecker CI
-    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(8000), 'Allow Woodpecker Web UI');
+    securityGroup.addIngressRule(ec2.Peer.ipv4('16.113.57.0/24'), ec2.Port.tcp(8000), 'Allow Woodpecker Web UI');
 
     // Django App Backends (Prod and Beta)
-    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(8080), 'Allow Django Beta Backend');
-    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(8090), 'Allow Django Production Backend');
+    securityGroup.addIngressRule(ec2.Peer.ipv4('16.113.57.0/24'), ec2.Port.tcp(8080), 'Allow Django Beta Backend');
+    securityGroup.addIngressRule(ec2.Peer.ipv4('16.113.57.0/24'), ec2.Port.tcp(8090), 'Allow Django Production Backend');
 
 
     // Create IAM Role for EC2 Instance (to allow CloudWatch Agent to write logs & metrics)