diff --git a/scripts/firewall_private_proxy.sh b/scripts/firewall_private_proxy.sh
new file mode 100644
index 0000000..342dd1b
--- /dev/null
+++ b/scripts/firewall_private_proxy.sh
@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+FASTPANEL_PROXY_IP="${FASTPANEL_PROXY_IP:-192.168.0.221}"
+MATRIX_PORT="${MATRIX_PORT:-8008}"
+ALLOW_SSH="${ALLOW_SSH:-yes}"
+SSH_PORT="${SSH_PORT:-22}"
+APPLY_UFW_DEFAULTS="${APPLY_UFW_DEFAULTS:-no}"
+
+log() { echo "[INFO] $*"; }
+warn() { echo "[WARN] $*"; }
+fail() { echo "[ERROR] $*" >&2; exit 1; }
+
+need_root() {
+    if [ "$(id -u)" -ne 0 ]; then
+        fail "Run as root: sudo FASTPANEL_PROXY_IP=$FASTPANEL_PROXY_IP bash scripts/firewall_private_proxy.sh"
+    fi
+}
+
+need_command() {
+    command -v "$1" >/dev/null 2>&1 || fail "Required command not found: $1"
+}
+
+main() {
+    need_root
+    need_command ufw
+
+    log "Configuring UFW for Matrix private reverse proxy"
+    echo "  FastPanel proxy IP: $FASTPANEL_PROXY_IP"
+    echo "  Matrix port:        $MATRIX_PORT"
+
+    if [ "$ALLOW_SSH" = "yes" ]; then
+        ufw allow "$SSH_PORT"/tcp comment 'allow SSH'
+    else
+        warn "ALLOW_SSH is not yes, SSH rule was not added"
+    fi
+
+    ufw allow from "$FASTPANEL_PROXY_IP" to any port "$MATRIX_PORT" proto tcp comment 'Pulse Matrix from FastPanel proxy'
+    ufw deny "$MATRIX_PORT"/tcp comment 'deny public Matrix direct access'
+
+    if [ "$APPLY_UFW_DEFAULTS" = "yes" ]; then
+        ufw default deny incoming
+        ufw default allow outgoing
+    else
+        warn "UFW default policy not changed. Set APPLY_UFW_DEFAULTS=yes if this is a clean Core server."
+    fi
+
+    ufw --force enable
+
+    echo
+    log "Current UFW status"
+    ufw status numbered
+
+    echo
+    log "Done. Verify from FastPanel proxy: curl http://<CORE_PRIVATE_IP>:$MATRIX_PORT/_matrix/client/versions"
+}
+
+main "$@"