configuring-firewalls
Master firewall configuration across UFW, nftables, iptables, and cloud platforms like AWS, GCP, and Azure. This skill covers stateful and stateless rule patterns, defense-in-depth strategies, and safety practices to prevent lockouts while hardening servers and implementing network segmentation.
Configuring Firewalls helps you set up host-based and cloud firewall rules for servers, services, and network segmentation.
AI-generated summary based on this skill's SKILL.md
Install
ancoleman/ai-design-components/configuring-firewalls · repository language: Python
git clone https://github.com/ancoleman/ai-design-components
cp -r ai-design-components/skills/configuring-firewalls ~/.claude/skills/configuring-firewallsnpx skillfed install ancoleman/ai-design-components/configuring-firewallsFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How do I configure firewall on an Ubuntu server?
Configuring-firewalls on Ubuntu typically uses UFW (Uncomplicated Firewall) for simplicity. Enable UFW with `sudo ufw enable`, then add rules like `sudo ufw allow 22/tcp` for SSH or `sudo ufw allow 443/tcp` for HTTPS. Check rules with `sudo ufw status`. UFW abstracts iptables complexity while maintaining stateful filtering. Always test SSH access before enabling to prevent lockouts.
What's the difference between iptables vs nftables which should I use?
Configuring-firewalls involves choosing between iptables (legacy, widely deployed) and nftables (modern replacement). nftables offers unified syntax for IPv4/IPv6, better performance, and simpler rule management. Use nftables for new deployments; migrate from iptables if your distribution supports it. Both achieve the same filtering goals, but nftables reduces complexity in large rulesets.
How do I prevent SSH lockout when enabling firewall?
Configuring-firewalls safely requires allowing SSH before enforcement. Add `sudo ufw allow 22/tcp` before `sudo ufw enable`. If locked out, reboot into recovery mode or use console access to disable the firewall. Test connectivity from another terminal before finalizing rules. This practice prevents accidental self-lockout during defense-in-depth implementation.
What are AWS Security Groups vs NACLs and how do they differ?
Configuring-firewalls in AWS uses two layers: Security Groups (stateful, instance-level) and NACLs (stateless, subnet-level). Security Groups track connection state automatically; NACLs require explicit allow/deny for both directions. Use Security Groups for most rules; NACLs add defense-in-depth filtering at the subnet boundary. Both integrate with Terraform for infrastructure-as-code firewall management.
How do I set up defense-in-depth firewall strategy?
Configuring-firewalls with defense-in-depth layers multiple boundaries: host-level (UFW/nftables), cloud perimeter (Security Groups/NACLs), and application-level (Kubernetes Network Policies). Restrict egress traffic, segment networks by function, and log all denied connections. This multi-layer approach limits blast radius if one boundary is compromised.
What firewall rules do I need for a web server?
Configuring-firewalls for web servers typically allows inbound port 80 (HTTP) and 443 (HTTPS), restricts SSH to admin IPs, and blocks unnecessary services. Use `sudo ufw allow 80/tcp` and `sudo ufw allow 443/tcp`. Implement egress filtering to prevent data exfiltration. Log denied connections for troubleshooting and security monitoring.
SKILL.md
rendered from the published skill — quoted content, verbatim
Configuring Firewalls
Purpose
Guide engineers through configuring firewalls across host-based (iptables, nftables, UFW), cloud-based (AWS Security Groups, NACLs), and container-based (Kubernetes NetworkPolicies) environments with practical rule examples and safety patterns to prevent lockouts and security misconfigurations.
When to Use This Skill
Trigger Phrases: - "Configure firewall for [server/service]" - "Set up security groups for [AWS resource]" - "Allow port [X] through firewall" - "Block IP address [X.X.X.X]" - "Set up UFW on Ubuntu server" - "Create iptables/nftables rules" - "Configure bastion host firewall" - "Implement egress filtering"
Common Scenarios: - Initial server setup and hardening - Exposing a new service (web server, API, database) - Implementing network segmentation - Creating bastion
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 15 files
skills/configuring-firewalls/SKILL.md
skills/configuring-firewalls/examples/kubernetes/default-deny-allow-dns.yaml
skills/configuring-firewalls/examples/nftables/web-server.nft
skills/configuring-firewalls/examples/terraform-aws/three-tier-architecture.tf
skills/configuring-firewalls/examples/ufw/basic-web-server.sh
skills/configuring-firewalls/outputs.yaml
skills/configuring-firewalls/references/aws-security-groups.md
skills/configuring-firewalls/references/azure-nsg.md
skills/configuring-firewalls/references/bastion-pattern.md
skills/configuring-firewalls/references/database-patterns.md
skills/configuring-firewalls/references/decision-tree.md
skills/configuring-firewalls/references/dmz-pattern.md
skills/configuring-firewalls/references/egress-filtering.md
skills/configuring-firewalls/references/gcp-firewall.md
skills/configuring-firewalls/references/iptables-patterns.md