{"enrichment":{"faq":[{"a":"firewall-config covers iptables setup with default deny policies and connection tracking. Start by setting INPUT, OUTPUT, and FORWARD chains to DROP, then explicitly allow required traffic (SSH, HTTP, HTTPS). Use stateful rules to track established connections. For persistence, save rules with iptables-save and restore via /etc/iptables/rules.v4 or systemd services. firewall-config includes examples for common protocols and best practices for rule ordering.","q":"How do I configure iptables firewall rules on Linux?"},{"a":"firewall-config demonstrates restricting SSH by source IP range using iptables or nftables. Add a rule allowing port 22 only from your management subnet's CIDR block, then deny all other SSH traffic. Example: `iptables -A INPUT -p tcp --dport 22 -s 10.0.1.0/24 -j ACCEPT` followed by `iptables -A INPUT -p tcp --dport 22 -j DROP`. This implements network segmentation principles covered in firewall-config.","q":"What's the best way to block SSH access except from a management subnet?"},{"a":"firewall-config covers nftables configuration for tier isolation. Define separate chains for web, app, and database tiers with explicit allow/deny rules. Use nftables sets to group IPs by tier, then apply rules restricting cross-tier traffic. For example, allow app tier to reach database only on port 5432. firewall-config includes migration guidance from iptables and rule ordering to prevent conflicts.","q":"How should I set up nftables for network segmentation between application tiers?"},{"a":"firewall-config addresses DDoS protection through iptables/nftables rate limiting and SYN flood defenses. Use `limit` matches to restrict connection rates per IP, and `connlimit` to cap concurrent connections. Example: `iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/minute -j ACCEPT`. firewall-config also covers SYN cookies and connection tracking tuning for incident response blocking.","q":"How can I protect against DDoS attacks using rate limiting and connection limits?"},{"a":"firewall-config emphasizes default deny policies, explicit allow rules, and regular audits. Implement least-privilege access, document rule purposes, use security zones for segmentation, and maintain persistent rule storage. Audit rules with scripts to verify compliance and troubleshoot common issues like rule ordering conflicts or Docker iptables interference. firewall-config includes compliance-focused examples and troubleshooting guidance.","q":"What are firewall configuration best practices for security compliance?"},{"a":"firewall-config covers cloud firewall setup across AWS, GCP, and Azure. For AWS, define security groups with ingress/egress rules specifying protocol, port, and source/destination. Use Terraform to codify rules for consistency and version control. firewall-config includes examples for restricting database access to app tier, implementing security zones, and managing rule changes\u2014applicable to host-based and cloud environments.","q":"How do I configure AWS security groups and cloud firewalls with Terraform?"}],"shadow_tags":["host-based-security","cloud-networking","traffic-filtering","ddos-mitigation","access-control","network-isolation","rule-persistence","compliance-auditing","incident-response"],"summary_rewrite":"Set up host-based and cloud firewalls across Linux systems and AWS environments. This skill covers iptables and nftables configuration for traffic filtering, network segmentation between application tiers, and cloud security group rules\u2014with examples for DDoS protection, rate limiting, and incident response blocking."},"files":[{"bytes":11689,"path":"security/network/firewall-config/SKILL.md","sha256":"707aedfc19679bc0cdddd32b0fcdbb05aab692502ff68a1030f243e405bbe62b","url":"https://skillfed.io/files/BagelHole/DevOps-Security-Agent-Skills/firewall-config/2bf567f2/SKILL.md"}],"id":"BagelHole/DevOps-Security-Agent-Skills/firewall-config","links":{"html":"https://skillfed.io/BagelHole/DevOps-Security-Agent-Skills/firewall-config","md":"https://skillfed.io/BagelHole/DevOps-Security-Agent-Skills/firewall-config.md","repo":"https://github.com/BagelHole/DevOps-Security-Agent-Skills"},"meta":{"agents_supported":[],"first_seen":"2026-07-28","forks":4,"language":"Shell","last_updated":"2026-05-22","license":"MIT","name":"firewall-config","publisher":"BagelHole","stars":44},"relations":{"similar":[{"id":"ancoleman/ai-design-components/configuring-firewalls"},{"id":"chaterm/terminal-skills/firewall"},{"id":"personamanagmentlayer/pcl/terraform-expert"},{"id":"nahisaho/MUSUBI/cloud-architect"},{"id":"manutej/luxor-claude-marketplace/terraform-infrastructure-as-code"},{"id":"personamanagmentlayer/pcl/devops-expert"},{"id":"BagelHole/DevOps-Security-Agent-Skills/linux-hardening"},{"id":"snyk/studio-recipes/iac-security"},{"id":"chaterm/terminal-skills/proxy"},{"id":"Aradotso/data-skills/iac-data-engineering-terraform"}]},"slug":{"owner":"BagelHole","repo":"DevOps-Security-Agent-Skills","skill":"firewall-config"},"version":"2bf567f2"}