diff --git a/certidude/api/attrib.py b/certidude/api/attrib.py
index 1b3d948..fde9931 100644
--- a/certidude/api/attrib.py
+++ b/certidude/api/attrib.py
@@ -4,9 +4,10 @@ import re
 from xattr import setxattr, listxattr, removexattr
 from certidude import push
 from certidude.decorators import serialize, csrf_protection
-from certidude.firewall import whitelist_subject
 from certidude.auth import login_required, authorize_admin
 
+from .utils.firewall import whitelist_subject
+
 logger = logging.getLogger(__name__)
 
 class AttributeResource(object):
diff --git a/certidude/api/ocsp.py b/certidude/api/ocsp.py
index b9f0b15..508fb20 100644
--- a/certidude/api/ocsp.py
+++ b/certidude/api/ocsp.py
@@ -5,10 +5,10 @@ from asn1crypto.util import timezone
 from asn1crypto import ocsp
 from base64 import b64decode
 from certidude import config
-from certidude.firewall import whitelist_subnets
 from datetime import datetime
 from oscrypto import asymmetric
 from .utils import AuthorityHandler
+from .utils.firewall import whitelist_subnets
 
 logger = logging.getLogger(__name__)
 
diff --git a/certidude/api/request.py b/certidude/api/request.py
index c9aab93..e2d0640 100644
--- a/certidude/api/request.py
+++ b/certidude/api/request.py
@@ -10,12 +10,12 @@ from base64 import b64decode
 from certidude import config, push, errors
 from certidude.auth import login_required, login_optional, authorize_admin
 from certidude.decorators import csrf_protection, MyEncoder
-from certidude.firewall import whitelist_subnets, whitelist_content_types
 from datetime import datetime
 from oscrypto import asymmetric
 from oscrypto.errors import SignatureError
 from xattr import getxattr
 from .utils import AuthorityHandler
+from .utils.firewall import whitelist_subnets, whitelist_content_types
 
 logger = logging.getLogger(__name__)
 
diff --git a/certidude/api/revoked.py b/certidude/api/revoked.py
index fc6f448..44cb721 100644
--- a/certidude/api/revoked.py
+++ b/certidude/api/revoked.py
@@ -1,8 +1,8 @@
 import falcon
 import logging
 from certidude import const, config
-from certidude.firewall import whitelist_subnets
 from .utils import AuthorityHandler
+from .utils.firewall import whitelist_subnets
 
 logger = logging.getLogger(__name__)
 
diff --git a/certidude/api/scep.py b/certidude/api/scep.py
index 2c0f59c..dee63ba 100644
--- a/certidude/api/scep.py
+++ b/certidude/api/scep.py
@@ -4,10 +4,10 @@ from asn1crypto import cms, algos
 from asn1crypto.core import SetOf, PrintableString
 from base64 import b64decode
 from certidude import config
-from certidude.firewall import whitelist_subnets
 from oscrypto import keys, asymmetric, symmetric
 from oscrypto.errors import SignatureError
 from .utils import AuthorityHandler
+from .utils.firewall import whitelist_subnets
 
 # Monkey patch asn1crypto
 
diff --git a/certidude/api/script.py b/certidude/api/script.py
index dd2066d..db3f4bf 100644
--- a/certidude/api/script.py
+++ b/certidude/api/script.py
@@ -2,8 +2,8 @@ import logging
 import os
 from certidude import const, config
 from jinja2 import Environment, FileSystemLoader
-from certidude.firewall import whitelist_subject
 from .utils import AuthorityHandler
+from .utils.firewall import whitelist_subject
 
 logger = logging.getLogger(__name__)
 env = Environment(loader=FileSystemLoader(config.SCRIPT_DIR), trim_blocks=True)
diff --git a/certidude/api/utils.py b/certidude/api/utils/__init__.py
similarity index 100%
rename from certidude/api/utils.py
rename to certidude/api/utils/__init__.py
diff --git a/certidude/firewall.py b/certidude/api/utils/firewall.py
similarity index 100%
rename from certidude/firewall.py
rename to certidude/api/utils/firewall.py
diff --git a/certidude/auth.py b/certidude/auth.py
index e57208d..e0abc4e 100644
--- a/certidude/auth.py
+++ b/certidude/auth.py
@@ -9,7 +9,6 @@ import re
 import socket
 from base64 import b64decode
 from certidude.user import User
-from certidude.firewall import whitelist_subnets
 from certidude import config, const
 
 logger = logging.getLogger("api")