diff --git a/src/main/java/org/elasticsearch/shield/transport/netty/NettySecuredHttpServerTransport.java b/src/main/java/org/elasticsearch/shield/transport/netty/NettySecuredHttpServerTransport.java
index 0db6a2b316e..13527b5e683 100644
--- a/src/main/java/org/elasticsearch/shield/transport/netty/NettySecuredHttpServerTransport.java
+++ b/src/main/java/org/elasticsearch/shield/transport/netty/NettySecuredHttpServerTransport.java
@@ -57,14 +57,14 @@ public class NettySecuredHttpServerTransport extends NettyHttpServerTransport {
         @Override
         public ChannelPipeline getPipeline() throws Exception {
             ChannelPipeline pipeline = super.getPipeline();
-            if (shieldUpstreamHandler != null) {
-                pipeline.addFirst("ipfilter", shieldUpstreamHandler);
-            }
             if (ssl) {
                 SSLEngine engine = sslConfig.createSSLEngine();
                 engine.setUseClientMode(false);
                 pipeline.addFirst("ssl", new SslHandler(engine));
             }
+            if (shieldUpstreamHandler != null) {
+                pipeline.addFirst("ipfilter", shieldUpstreamHandler);
+            }
             return pipeline;
         }
     }
diff --git a/src/main/java/org/elasticsearch/shield/transport/netty/NettySecuredTransport.java b/src/main/java/org/elasticsearch/shield/transport/netty/NettySecuredTransport.java
index 9dace2cc907..fdd6d936735 100644
--- a/src/main/java/org/elasticsearch/shield/transport/netty/NettySecuredTransport.java
+++ b/src/main/java/org/elasticsearch/shield/transport/netty/NettySecuredTransport.java
@@ -64,9 +64,6 @@ public class NettySecuredTransport extends NettyTransport {
         @Override
         public ChannelPipeline getPipeline() throws Exception {
             ChannelPipeline pipeline = super.getPipeline();
-            if (shieldUpstreamHandler != null) {
-                pipeline.addFirst("ipfilter", shieldUpstreamHandler);
-            }
             if (ssl) {
                 SSLEngine serverEngine = sslConfig.createSSLEngine();
                 serverEngine.setUseClientMode(false);
@@ -74,6 +71,9 @@ public class NettySecuredTransport extends NettyTransport {
                 pipeline.addFirst("ssl", new SslHandler(serverEngine));
                 pipeline.replace("dispatcher", "dispatcher", new SecuredMessageChannelHandler(nettyTransport, logger));
             }
+            if (shieldUpstreamHandler != null) {
+                pipeline.addFirst("ipfilter", shieldUpstreamHandler);
+            }
             return pipeline;
         }
     }