diff --git a/quart_common b/quart_common
index be555d8..b2f4859 160000
--- a/quart_common
+++ b/quart_common
@@ -1 +1 @@
-Subproject commit be555d897e9aa2d9f4f5ac6912ecc1eb93769be9
+Subproject commit b2f485908b362311190a913b22ab4aebdae928c2
diff --git a/server/blueprints/metrics.py b/server/blueprints/metrics.py
index 07ce75a..977f7dd 100644
--- a/server/blueprints/metrics.py
+++ b/server/blueprints/metrics.py
@@ -1,3 +1,5 @@
+from quart_common.web.decorators import restrict_ip_addresses
+
 from quart import Blueprint, jsonify
 from typing import TYPE_CHECKING
 
@@ -8,6 +10,7 @@ def create_metrics_blueprint(server:'Server') -> Blueprint:
   blueprint = Blueprint('metrics', __name__)
 
   @blueprint.get('/metrics')
+  @restrict_ip_addresses(allow=['192.168.188.0/24', '192.168.200.0/24'], abort_code=404)
   async def metrics():
     snapshot = await server.metrics_collector.build_snapshot(
       server.game_runtime.game_last_seen_unix,
@@ -16,6 +19,7 @@ def create_metrics_blueprint(server:'Server') -> Blueprint:
     return jsonify(snapshot)
 
   @blueprint.get('/metrics/prometheus')
+  @restrict_ip_addresses(allow=['192.168.188.0/24', '192.168.200.0/24'], abort_code=404)
   async def metrics_prometheus():
     snapshot = await server.metrics_collector.build_snapshot(
       server.game_runtime.game_last_seen_unix,