networking
This skill guides you through building production-grade network infrastructure for self-hosted environments. It covers VLAN segmentation by trust level, firewall configuration across nftables, OPNsense, and pfSense, DNS architecture with Pi-hole and AdGuard Home, reverse proxies like Caddy and Traefik, VPN setup with WireGuard and Tailscale, certificate automation, and security hardening patterns. Use it whenever you're designing, implementing, or troubleshooting network topology, access control, or encrypted communications.
Networking skill helps you design and implement secure self-hosted network infrastructure with VLANs, firewalls, and encrypted tunnels.
AI-generated summary based on this skill's SKILL.md
Install
xobotyi/cc-foundry/networking · repository language: JavaScript
git clone https://github.com/xobotyi/cc-foundry
cp -r cc-foundry/plugins/infrastructure/skills/networking ~/.claude/skills/networkingnpx skillfed install xobotyi/cc-foundry/networkingFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How to set up VLANs for a home network with networking?
networking guides you through VLAN segmentation by trust level to isolate devices and services. Start by identifying your trust zones—management, trusted devices, IoT, and guest networks—then configure VLAN IDs on your switch and router. Use firewall rules to control inter-VLAN traffic, allowing only necessary communication paths. This prevents compromised IoT devices from accessing sensitive services and limits lateral movement during security incidents.
What firewall rules should I use with nftables or OPNsense in networking?
networking covers firewall configuration across nftables, OPNsense, and pfSense. Start with a default-deny policy, then explicitly allow required traffic by source, destination, and port. For nftables, define tables and chains for ingress/egress filtering. In OPNsense, use the GUI to create rules tied to interfaces and VLANs. Apply stateful inspection to track connections and block unsolicited inbound traffic. Document your ruleset for auditability.
How does networking help with WireGuard versus Tailscale VPN?
networking covers VPN deployment with both WireGuard and Tailscale. WireGuard offers lower overhead and direct peer-to-peer connections; use it when you control both endpoints and want minimal latency. Tailscale provides easier setup, NAT traversal, and centralized key management through its coordination server; choose it for mixed environments or when simplicity matters. networking guides configuration, key rotation, and access policies for each.
How do I configure DNS filtering and split-horizon resolution with networking?
networking teaches DNS architecture using Pi-hole or AdGuard Home for filtering and blocking. Set up split-horizon DNS to resolve internal hostnames (like services.local) to private IPs for internal clients and external IPs or block them for external queries. Configure your DHCP server to point clients to your DNS resolver, then add blocklists and custom records. This prevents DNS leaks and allows seamless access to self-hosted services.
What does networking cover for reverse proxy and TLS certificate setup?
networking guides reverse proxy configuration with Caddy and Traefik, plus TLS automation via Let's Encrypt and ACME. Set up your reverse proxy to accept external traffic, route it to internal services, and terminate TLS. Use wildcard certificates for multiple subdomains and automate renewal. networking covers certificate pinning, HSTS headers, and integration with Docker for container-based deployments.
How can networking help harden SSH and monitor network security?
networking covers SSH hardening with key-based auth, non-standard ports, and fail2ban to block brute-force attempts. It includes IDS/IPS setup with Suricata and CrowdSec to detect intrusions and anomalies. Add network monitoring with Prometheus and Grafana to track traffic patterns and alert on suspicious activity. These layers detect and respond to threats before they compromise your infrastructure.
SKILL.md
rendered from the published skill — quoted content, verbatim
Networking
Security is a non-negotiable default, not an optional add-on. Every network design decision must account for trust boundaries.
References
Extended configuration examples, comparison tables, and detailed patterns for the rules below live in
${CLAUDE_SKILL_DIR}/references/.
vlan-segmentation.md— VLAN design, trunk/access ports, inter-VLAN policy, Layer 2 security: segment table, firewall rule matrix, hardware requirements, DHCP snooping, DAI, port security, L2 attack mitigationfirewall-rules.md— nftables syntax, OPNsense/pfSense hardening, IPv6 firewall rules: chain types/hooks/priorities, connection tracking, NAT, rate limiting, sets/maps, ICMPv6 policy,
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 10 files
plugins/infrastructure/skills/networking/.dev/reference-inventory.json
plugins/infrastructure/skills/networking/SKILL.md
plugins/infrastructure/skills/networking/references/auth-proxies.md
plugins/infrastructure/skills/networking/references/dns-architecture.md
plugins/infrastructure/skills/networking/references/firewall-rules.md
plugins/infrastructure/skills/networking/references/reverse-proxy.md
plugins/infrastructure/skills/networking/references/security-hardening.md
plugins/infrastructure/skills/networking/references/tls-certificates.md
plugins/infrastructure/skills/networking/references/vlan-segmentation.md
plugins/infrastructure/skills/networking/references/vpn-tunnels.md