diff --git a/tasks/configure.yml b/tasks/configure.yml
index 730eefa78bf39d504a9d4103b3f5cbf96d393769..668458808aec62609e13b582b23ac8b88b4a1efe 100644
--- a/tasks/configure.yml
+++ b/tasks/configure.yml
@@ -85,6 +85,16 @@
     - 'blacklist.agent'
   notify: "Check HAProxy Config"
 
+- name: "Update private ips"
+  template:
+    src='privatelist.ip.jinja2'
+    dest='/etc/haproxy/privatelist.ip'
+    owner='root'
+    group='root'
+    mode='644'
+  when: haproxy_private is defined
+  notify: "Check HAProxy Config"
+
 - name: "Create config file"
   template:
     src='haproxy_cfg.jinja2'
diff --git a/templates/haproxy_cfg.jinja2 b/templates/haproxy_cfg.jinja2
index c06c37730d36f86218c5874c4e63b14dfc9dd2a7..97fe6b1a3728a186d9eacc2b8e84b36994ebfb98 100644
--- a/templates/haproxy_cfg.jinja2
+++ b/templates/haproxy_cfg.jinja2
@@ -49,10 +49,22 @@ userlist kibana
   user {{ user.username }} insecure-password '{{ user.password }}'
 {% endfor %}
 {% endif %}
+{% if haproxy_private is defined %}
+
+userlist notprivate
+{% for user in haproxy_private.auth %}
+  user {{ user.username }} insecure-password '{{ user.password }}'
+{% endfor %}
+{% endif %}
 
 frontend http_in
   bind *:80
   http-request del-header Proxy
+{% if haproxy_private is defined %}
+  acl privateip src -f /etc/haproxy/privatelist.ip
+  acl private_auth http_auth(notprivate) if !privateip
+  http-request auth realm notprivate if !privateip !private_auth
+{% endif %}
   acl blockedip src -f /etc/haproxy/blacklist.ip
   http-request deny if blockedip
   acl blockedreferer hdr_sub(referer) -i -f /etc/haproxy/blacklist.referer
@@ -170,6 +182,11 @@ frontend http_in
 frontend https_in_{{ cert.ip }}
   bind {{ cert.ip }}:443 ssl crt /etc/haproxy/certs/{{ cert.file }} no-sslv3
   http-request del-header Proxy
+{% if haproxy_private is defined %}
+  acl privateip src -f /etc/haproxy/privatelist.ip
+  acl private_auth http_auth(notprivate) if !privateip
+  http-request auth realm notprivate if !privateip !private_auth
+{% endif %}
   acl blockedip src -f /etc/haproxy/blacklist.ip
   http-request deny if blockedip
   acl blockedreferer hdr_sub(referer) -i -f /etc/haproxy/blacklist.referer
diff --git a/templates/privatelist.ip.jinja2 b/templates/privatelist.ip.jinja2
new file mode 100644
index 0000000000000000000000000000000000000000..32be90d06a28a0250fc2516aa51b27ad1ecb8557
--- /dev/null
+++ b/templates/privatelist.ip.jinja2
@@ -0,0 +1,3 @@
+{% for ip in haproxy_private.ip %}
+{{ ip }}
+{% endfor %}