configuring-firewalls
Master firewall configuration across UFW, nftables, iptables, and cloud platforms like AWS, GCP, and Azure. This skill covers stateful and stateless rule patterns, defense-in-depth strategies, and safety practices to prevent lockouts while hardening servers and implementing network segmentation.
Configuring Firewalls helps you set up host-based and cloud firewall rules for servers, services, and network segmentation.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2025-12-11
Configuring Firewalls helps you set up host-based and cloud firewall rules for servers, services, and network segmentation. Master firewall configuration across UFW, nftables, iptables, and cloud platforms like AWS, GCP, and Azure. This skill covers stateful and stateless rule patterns, defense-in-depth strategies, and safety practices to prevent lockouts while hardening servers and implementing network segmentation.
Use it when
- Configuring-firewalls involves choosing between iptables (legacy, widely deployed) and nftables (modern replacement).
- Configuring-firewalls safely requires allowing SSH before enforcement.
Verify before relying
Read SKILL.md below before installing (20 files). Open directory: indexed for reading, not audited.
Install
ancoleman/ai-design-components/configuring-firewalls · repository language: Python
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How do I configure firewall on an Ubuntu server?
Configuring-firewalls on Ubuntu typically uses UFW (Uncomplicated Firewall) for simplicity. Enable UFW with `sudo ufw enable`, then add rules like `sudo ufw allow 22/tcp` for SSH or `sudo ufw allow 443/tcp` for HTTPS. Check rules with `sudo ufw status`. UFW abstracts iptables complexity while maintaining stateful filtering. Always test SSH access before enabling to prevent lockouts.
What's the difference between iptables vs nftables which should I use?
Configuring-firewalls involves choosing between iptables (legacy, widely deployed) and nftables (modern replacement). nftables offers unified syntax for IPv4/IPv6, better performance, and simpler rule management. Use nftables for new deployments; migrate from iptables if your distribution supports it. Both achieve the same filtering goals, but nftables reduces complexity in large rulesets.
How do I prevent SSH lockout when enabling firewall?
Configuring-firewalls safely requires allowing SSH before enforcement. Add `sudo ufw allow 22/tcp` before `sudo ufw enable`. If locked out, reboot into recovery mode or use console access to disable the firewall. Test connectivity from another terminal before finalizing rules. This practice prevents accidental self-lockout during defense-in-depth implementation.
What are AWS Security Groups vs NACLs and how do they differ?
Configuring-firewalls in AWS uses two layers: Security Groups (stateful, instance-level) and NACLs (stateless, subnet-level). Security Groups track connection state automatically; NACLs require explicit allow/deny for both directions. Use Security Groups for most rules; NACLs add defense-in-depth filtering at the subnet boundary. Both integrate with Terraform for infrastructure-as-code firewall management.
How do I set up defense-in-depth firewall strategy?
Configuring-firewalls with defense-in-depth layers multiple boundaries: host-level (UFW/nftables), cloud perimeter (Security Groups/NACLs), and application-level (Kubernetes Network Policies). Restrict egress traffic, segment networks by function, and log all denied connections. This multi-layer approach limits blast radius if one boundary is compromised.
What firewall rules do I need for a web server?
Configuring-firewalls for web servers typically allows inbound port 80 (HTTP) and 443 (HTTPS), restricts SSH to admin IPs, and blocks unnecessary services. Use `sudo ufw allow 80/tcp` and `sudo ufw allow 443/tcp`. Implement egress filtering to prevent data exfiltration. Log denied connections for troubleshooting and security monitoring.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
Configuring Firewalls
Purpose
Guide engineers through configuring firewalls across host-based (iptables, nftables, UFW), cloud-based (AWS Security Groups, NACLs), and container-based (Kubernetes NetworkPolicies) environments with practical rule examples and safety patterns to prevent lockouts and security misconfigurations.
When to Use This Skill
Trigger Phrases: - "Configure firewall for [server/service]" - "Set up security groups for [AWS resource]" - "Allow port [X] through firewall" - "Block IP address [X.X.X.X]" - "Set up UFW on Ubuntu server" - "Create iptables/nftables rules" - "Configure bastion host firewall" - "Implement egress filtering"
Common Scenarios: - Initial server setup and hardening - Exposing a new service (web server, API, database) - Implementing network segmentation - Creating bastion
(truncated - see the full file via the links below)
File tree — 15 files
skills/configuring-firewalls/SKILL.md
skills/configuring-firewalls/examples/kubernetes/default-deny-allow-dns.yaml
skills/configuring-firewalls/examples/nftables/web-server.nft
skills/configuring-firewalls/examples/terraform-aws/three-tier-architecture.tf
skills/configuring-firewalls/examples/ufw/basic-web-server.sh
skills/configuring-firewalls/outputs.yaml
skills/configuring-firewalls/references/aws-security-groups.md
skills/configuring-firewalls/references/azure-nsg.md
skills/configuring-firewalls/references/bastion-pattern.md
skills/configuring-firewalls/references/database-patterns.md
skills/configuring-firewalls/references/decision-tree.md
skills/configuring-firewalls/references/dmz-pattern.md
skills/configuring-firewalls/references/egress-filtering.md
skills/configuring-firewalls/references/gcp-firewall.md
skills/configuring-firewalls/references/iptables-patterns.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Configure host and cloud firewalls with practical rules for servers and services”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Set up host-based and cloud firewalls across Linux systems and AWS environments. This skill covers iptables and nftables configuration for traffic filtering, network segmentation between application tiers, and cloud security group rules—with examples for DDoS protection, rate limiting, and incident response blocking.
This skill guides you through building production-grade network infrastructure for self-hosted environments. It covers VLAN segmentation by trust level, firewall configuration across nftables, OPNsense, and pfSense, DNS architecture with Pi-hole and AdGuard Home, reverse proxies like Caddy and Traefik, VPN setup with WireGuard and Tailscale, certificate automation, and security hardening patterns. Use it whenever you're designing, implementing, or troubleshooting network topology, access control, or encrypted communications.
This skill walks you through a methodical process for securing fresh Linux servers, starting with SSH key verification and progressing through non-root user creation, UFW firewall rules, fail2ban protection, and SSH hardening. Each stage includes verification steps to prevent lockout.
This skill guides you through five core workflows: securing new buckets, auditing existing configurations, remediating findings, configuring encryption, and enabling monitoring. It enforces layered security controls aligned with AWS Well-Architected principles, including versioning, encryption defaults, HTTPS-only policies, and attribute-based access control.
VPN Setup guides you through deploying WireGuard, OpenVPN, and managed VPN solutions like Tailscale for encrypted remote access and network-to-network tunneling. It covers server configuration, client setup, peer management, and cloud VPN integration with practical scripts and security hardening.
Configure Workers to reach private APIs across cloud providers and on-premise infrastructure using encrypted tunnels. This skill covers tunnel setup, VPC service creation, wrangler binding configuration, and the critical rules that prevent common errors like dns_error and requests leaking to public endpoints.
More skills cloudflare-one-migrations (Apache-2.0)