firewall-config
Set up host-based and cloud firewalls across Linux systems and AWS environments. This skill covers iptables and nftables configuration for traffic filtering, network segmentation between application tiers, and cloud security group rules—with examples for DDoS protection, rate limiting, and incident response blocking.
firewall-config sets up iptables, nftables, and cloud security groups to restrict network access and enforce security zones.
AI-generated summary based on this skill's SKILL.md
Install
BagelHole/DevOps-Security-Agent-Skills/firewall-config · repository language: Shell
git clone https://github.com/BagelHole/DevOps-Security-Agent-Skills
cp -r DevOps-Security-Agent-Skills/security/network/firewall-config ~/.claude/skills/firewall-confignpx skillfed install BagelHole/DevOps-Security-Agent-Skills/firewall-configFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How do I configure iptables firewall rules on Linux?
firewall-config covers iptables setup with default deny policies and connection tracking. Start by setting INPUT, OUTPUT, and FORWARD chains to DROP, then explicitly allow required traffic (SSH, HTTP, HTTPS). Use stateful rules to track established connections. For persistence, save rules with iptables-save and restore via /etc/iptables/rules.v4 or systemd services. firewall-config includes examples for common protocols and best practices for rule ordering.
What's the best way to block SSH access except from a management subnet?
firewall-config demonstrates restricting SSH by source IP range using iptables or nftables. Add a rule allowing port 22 only from your management subnet's CIDR block, then deny all other SSH traffic. Example: `iptables -A INPUT -p tcp --dport 22 -s 10.0.1.0/24 -j ACCEPT` followed by `iptables -A INPUT -p tcp --dport 22 -j DROP`. This implements network segmentation principles covered in firewall-config.
How should I set up nftables for network segmentation between application tiers?
firewall-config covers nftables configuration for tier isolation. Define separate chains for web, app, and database tiers with explicit allow/deny rules. Use nftables sets to group IPs by tier, then apply rules restricting cross-tier traffic. For example, allow app tier to reach database only on port 5432. firewall-config includes migration guidance from iptables and rule ordering to prevent conflicts.
How can I protect against DDoS attacks using rate limiting and connection limits?
firewall-config addresses DDoS protection through iptables/nftables rate limiting and SYN flood defenses. Use `limit` matches to restrict connection rates per IP, and `connlimit` to cap concurrent connections. Example: `iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/minute -j ACCEPT`. firewall-config also covers SYN cookies and connection tracking tuning for incident response blocking.
What are firewall configuration best practices for security compliance?
firewall-config emphasizes default deny policies, explicit allow rules, and regular audits. Implement least-privilege access, document rule purposes, use security zones for segmentation, and maintain persistent rule storage. Audit rules with scripts to verify compliance and troubleshoot common issues like rule ordering conflicts or Docker iptables interference. firewall-config includes compliance-focused examples and troubleshooting guidance.
How do I configure AWS security groups and cloud firewalls with Terraform?
firewall-config covers cloud firewall setup across AWS, GCP, and Azure. For AWS, define security groups with ingress/egress rules specifying protocol, port, and source/destination. Use Terraform to codify rules for consistency and version control. firewall-config includes examples for restricting database access to app tier, implementing security zones, and managing rule changes—applicable to host-based and cloud environments.
SKILL.md
rendered from the published skill — quoted content, verbatim
Firewall Configuration
Configure host-based and cloud firewalls for network security.
When to Use This Skill
Use this skill when: - Setting up a new server and need to restrict network access - Implementing network segmentation between application tiers - Configuring cloud security groups for AWS, GCP, or Azure resources - Migrating from iptables to nftables - Auditing existing firewall rules for compliance - Responding to a security incident requiring emergency network blocks
Prerequisites
- Root or sudo access on Linux hosts
- AWS CLI configured for cloud security groups
- Understanding of TCP/IP, ports, and protocols
- Network diagram showing required traffic flows
iptables
Basic Setup with Default Deny
```bash
Flush existing rules
iptables -F iptables -X iptables -t nat -F iptables -t mangle -F
Default policies - deny all inbound, allow outbound
iptables -P INPUT
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 5 files
security/network/firewall-config/SKILL.md
security/network/firewall-config/assets/iptables-rules.sh
security/network/firewall-config/references/iptables-guide.md
security/network/firewall-config/scripts/firewall-audit.sh
security/network/firewall-config/scripts/setup-ufw.sh