firewall-config
Set up host-based and cloud firewalls across Linux systems and AWS environments. This skill covers iptables and nftables configuration for traffic filtering, network segmentation between application tiers, and cloud security group rules—with examples for DDoS protection, rate limiting, and incident response blocking.
firewall-config sets up iptables, nftables, and cloud security groups to restrict network access and enforce security zones.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-05-22
firewall-config sets up iptables, nftables, and cloud security groups to restrict network access and enforce security zones. Set up host-based and cloud firewalls across Linux systems and AWS environments. This skill covers iptables and nftables configuration for traffic filtering, network segmentation between application tiers, and cloud security group rules—with examples for DDoS protection, rate limiting, and incident response blocking.
Use it when
- firewall-config demonstrates restricting SSH by source IP range using iptables or nftables.
- firewall-config covers nftables configuration for tier isolation.
Verify before relying
Read SKILL.md below before installing (5 files). Open directory: indexed for reading, not audited.
Similar skills
Install
BagelHole/DevOps-Security-Agent-Skills/firewall-config · repository language: Shell
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How do I configure iptables firewall rules on Linux?
firewall-config covers iptables setup with default deny policies and connection tracking. Start by setting INPUT, OUTPUT, and FORWARD chains to DROP, then explicitly allow required traffic (SSH, HTTP, HTTPS). Use stateful rules to track established connections. For persistence, save rules with iptables-save and restore via /etc/iptables/rules.v4 or systemd services. firewall-config includes examples for common protocols and best practices for rule ordering.
What's the best way to block SSH access except from a management subnet?
firewall-config demonstrates restricting SSH by source IP range using iptables or nftables. Add a rule allowing port 22 only from your management subnet's CIDR block, then deny all other SSH traffic. Example: `iptables -A INPUT -p tcp --dport 22 -s 10.0.1.0/24 -j ACCEPT` followed by `iptables -A INPUT -p tcp --dport 22 -j DROP`. This implements network segmentation principles covered in firewall-config.
How should I set up nftables for network segmentation between application tiers?
firewall-config covers nftables configuration for tier isolation. Define separate chains for web, app, and database tiers with explicit allow/deny rules. Use nftables sets to group IPs by tier, then apply rules restricting cross-tier traffic. For example, allow app tier to reach database only on port 5432. firewall-config includes migration guidance from iptables and rule ordering to prevent conflicts.
How can I protect against DDoS attacks using rate limiting and connection limits?
firewall-config addresses DDoS protection through iptables/nftables rate limiting and SYN flood defenses. Use `limit` matches to restrict connection rates per IP, and `connlimit` to cap concurrent connections. Example: `iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/minute -j ACCEPT`. firewall-config also covers SYN cookies and connection tracking tuning for incident response blocking.
What are firewall configuration best practices for security compliance?
firewall-config emphasizes default deny policies, explicit allow rules, and regular audits. Implement least-privilege access, document rule purposes, use security zones for segmentation, and maintain persistent rule storage. Audit rules with scripts to verify compliance and troubleshoot common issues like rule ordering conflicts or Docker iptables interference. firewall-config includes compliance-focused examples and troubleshooting guidance.
How do I configure AWS security groups and cloud firewalls with Terraform?
firewall-config covers cloud firewall setup across AWS, GCP, and Azure. For AWS, define security groups with ingress/egress rules specifying protocol, port, and source/destination. Use Terraform to codify rules for consistency and version control. firewall-config includes examples for restricting database access to app tier, implementing security zones, and managing rule changes—applicable to host-based and cloud environments.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
Firewall Configuration
Configure host-based and cloud firewalls for network security.
When to Use This Skill
Use this skill when: - Setting up a new server and need to restrict network access - Implementing network segmentation between application tiers - Configuring cloud security groups for AWS, GCP, or Azure resources - Migrating from iptables to nftables - Auditing existing firewall rules for compliance - Responding to a security incident requiring emergency network blocks
Prerequisites
- Root or sudo access on Linux hosts
- AWS CLI configured for cloud security groups
- Understanding of TCP/IP, ports, and protocols
- Network diagram showing required traffic flows
iptables
Basic Setup with Default Deny
```bash
Flush existing rules
iptables -F iptables -X iptables -t nat -F iptables -t mangle -F
Default policies - deny all inbound, allow outbound
iptables -P INPUT
(truncated - see the full file via the links below)
File tree — 5 files
security/network/firewall-config/SKILL.md
security/network/firewall-config/assets/iptables-rules.sh
security/network/firewall-config/references/iptables-guide.md
security/network/firewall-config/scripts/firewall-audit.sh
security/network/firewall-config/scripts/setup-ufw.sh
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Configure host-based and cloud firewalls to restrict network access and implement security zones”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Master firewall configuration across UFW, nftables, iptables, and cloud platforms like AWS, GCP, and Azure. This skill covers stateful and stateless rule patterns, defense-in-depth strategies, and safety practices to prevent lockouts while hardening servers and implementing network segmentation.
This skill guides you through building production-grade network infrastructure for self-hosted environments. It covers VLAN segmentation by trust level, firewall configuration across nftables, OPNsense, and pfSense, DNS architecture with Pi-hole and AdGuard Home, reverse proxies like Caddy and Traefik, VPN setup with WireGuard and Tailscale, certificate automation, and security hardening patterns. Use it whenever you're designing, implementing, or troubleshooting network topology, access control, or encrypted communications.
This skill automates CIS benchmark auditing across Linux and Kubernetes environments using industry-standard tools. Run security assessments, identify compliance gaps, and track remediation through a structured workflow that includes scanning, analysis, fixes, and validation.
VPN Setup guides you through deploying WireGuard, OpenVPN, and managed VPN solutions like Tailscale for encrypted remote access and network-to-network tunneling. It covers server configuration, client setup, peer management, and cloud VPN integration with practical scripts and security hardening.
Replace VPN access to internal services using Cloudflare's Zero Trust platform, which combines identity verification, device compliance checks, and encrypted tunnels to protect dashboards, admin panels, and on-premises apps. Enforce DNS-level threat filtering and support remote teams without opening inbound ports.
AWS S3 equips you with production-grade bucket configuration, from hardening with encryption and public access blocks to enforcing policies and setting up cross-region replication. Handle lifecycle transitions, presigned URLs, and access control in one skill.
More skills cloudflare-r2 (MIT) · cloudflare-workers (MIT)