diff --git a/roles/wireguard_server/tasks/wstunnel.yml b/roles/wireguard_server/tasks/wstunnel.yml
index d7d59a8..46ffaa8 100644
--- a/roles/wireguard_server/tasks/wstunnel.yml
+++ b/roles/wireguard_server/tasks/wstunnel.yml
@@ -38,7 +38,7 @@
       [Service]
       Type=simple
       User=nobody
-      ExecStart=/usr/local/bin/wstunnel server -r udp://127.0.0.1:{{ vars['wireguard-server']['internal-port'] }} ws://0.0.0.0:8080
+      ExecStart=/usr/local/bin/wstunnel server ws://0.0.0.0:8080 --restrict-to 127.0.0.1:{{ vars['wireguard-server']['internal-port'] }}
       Restart=always
       RestartSec=3