{"enrichment":{"faq":[{"a":"Configuring-firewalls on Ubuntu typically uses UFW (Uncomplicated Firewall) for simplicity. Enable UFW with `sudo ufw enable`, then add rules like `sudo ufw allow 22/tcp` for SSH or `sudo ufw allow 443/tcp` for HTTPS. Check rules with `sudo ufw status`. UFW abstracts iptables complexity while maintaining stateful filtering. Always test SSH access before enabling to prevent lockouts.","q":"How do I configure firewall on an Ubuntu server?"},{"a":"Configuring-firewalls involves choosing between iptables (legacy, widely deployed) and nftables (modern replacement). nftables offers unified syntax for IPv4/IPv6, better performance, and simpler rule management. Use nftables for new deployments; migrate from iptables if your distribution supports it. Both achieve the same filtering goals, but nftables reduces complexity in large rulesets.","q":"What's the difference between iptables vs nftables which should I use?"},{"a":"Configuring-firewalls safely requires allowing SSH before enforcement. Add `sudo ufw allow 22/tcp` before `sudo ufw enable`. If locked out, reboot into recovery mode or use console access to disable the firewall. Test connectivity from another terminal before finalizing rules. This practice prevents accidental self-lockout during defense-in-depth implementation.","q":"How do I prevent SSH lockout when enabling firewall?"},{"a":"Configuring-firewalls in AWS uses two layers: Security Groups (stateful, instance-level) and NACLs (stateless, subnet-level). Security Groups track connection state automatically; NACLs require explicit allow/deny for both directions. Use Security Groups for most rules; NACLs add defense-in-depth filtering at the subnet boundary. Both integrate with Terraform for infrastructure-as-code firewall management.","q":"What are AWS Security Groups vs NACLs and how do they differ?"},{"a":"Configuring-firewalls with defense-in-depth layers multiple boundaries: host-level (UFW/nftables), cloud perimeter (Security Groups/NACLs), and application-level (Kubernetes Network Policies). Restrict egress traffic, segment networks by function, and log all denied connections. This multi-layer approach limits blast radius if one boundary is compromised.","q":"How do I set up defense-in-depth firewall strategy?"},{"a":"Configuring-firewalls for web servers typically allows inbound port 80 (HTTP) and 443 (HTTPS), restricts SSH to admin IPs, and blocks unnecessary services. Use `sudo ufw allow 80/tcp` and `sudo ufw allow 443/tcp`. Implement egress filtering to prevent data exfiltration. Log denied connections for troubleshooting and security monitoring.","q":"What firewall rules do I need for a web server?"}],"shadow_tags":["host-based-security","cloud-networking","access-control","network-segmentation","infrastructure-hardening","container-isolation","rule-management","traffic-filtering","zero-trust-networking","compliance-enforcement"],"summary_rewrite":"Master firewall configuration across UFW, nftables, iptables, and cloud platforms like AWS, GCP, and Azure. This skill covers stateful and stateless rule patterns, defense-in-depth strategies, and safety practices to prevent lockouts while hardening servers and implementing network segmentation."},"files":[{"bytes":13905,"path":"skills/configuring-firewalls/SKILL.md","sha256":"9f6852203168e5564ddbe5e2aba710fe33d2b87d3e8b4a1974abd9473a37b7fe","url":"https://skillfed.io/files/ancoleman/ai-design-components/configuring-firewalls/681a2309/SKILL.md"}],"id":"ancoleman/ai-design-components/configuring-firewalls","links":{"html":"https://skillfed.io/ancoleman/ai-design-components/configuring-firewalls","md":"https://skillfed.io/ancoleman/ai-design-components/configuring-firewalls.md","repo":"https://github.com/ancoleman/ai-design-components"},"meta":{"agents_supported":[],"first_seen":"2026-07-28","forks":59,"language":"Python","last_updated":"2025-12-11","license":"MIT","name":"configuring-firewalls","publisher":"ancoleman","stars":390},"relations":{"similar":[{"id":"BagelHole/DevOps-Security-Agent-Skills/firewall-config"},{"id":"chaterm/terminal-skills/firewall"},{"id":"RightNow-AI/openfang/linux-networking"},{"id":"BagelHole/DevOps-Security-Agent-Skills/linux-hardening"},{"id":"xobotyi/cc-foundry/networking"},{"id":"itsmostafa/aws-agent-skills/ec2"},{"id":"majesticlabs-dev/majestic-marketplace/hetzner-coder"},{"id":"Aradotso/security-skills/server-security-init-skill"},{"id":"aj-geddes/useful-ai-prompts/network-security-groups"},{"id":"BagelHole/DevOps-Security-Agent-Skills/ssh-configuration"}]},"slug":{"owner":"ancoleman","repo":"ai-design-components","skill":"configuring-firewalls"},"version":"681a2309"}