networking
This skill guides you through building production-grade network infrastructure for self-hosted environments. It covers VLAN segmentation by trust level, firewall configuration across nftables, OPNsense, and pfSense, DNS architecture with Pi-hole and AdGuard Home, reverse proxies like Caddy and Traefik, VPN setup with WireGuard and Tailscale, certificate automation, and security hardening patterns. Use it whenever you're designing, implementing, or troubleshooting network topology, access control, or encrypted communications.
Networking skill helps you design and implement secure self-hosted network infrastructure with VLANs, firewalls, and encrypted tunnels.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-10
Networking skill helps you design and implement secure self-hosted network infrastructure with VLANs, firewalls, and encrypted tunnels. This skill guides you through building production-grade network infrastructure for self-hosted environments. It covers VLAN segmentation by trust level, firewall configuration across nftables, OPNsense, and pfSense, DNS architecture with Pi-hole and AdGuard Home, reverse proxies like Caddy and Traefik, VPN setup with WireGuard and Tailscale, certificate automation, and security hardening patterns. Use it whenever you're designing, implementing, or troubleshooting network topology, access control, or encrypted communications.
Use it when
- networking covers firewall configuration across nftables, OPNsense, and pfSense.
- networking covers VPN deployment with both WireGuard and Tailscale.
Verify before relying
Read SKILL.md below before installing (10 files). Open directory: indexed for reading, not audited.
Install
xobotyi/cc-foundry/networking · repository language: JavaScript
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How to set up VLANs for a home network with networking?
networking guides you through VLAN segmentation by trust level to isolate devices and services. Start by identifying your trust zones—management, trusted devices, IoT, and guest networks—then configure VLAN IDs on your switch and router. Use firewall rules to control inter-VLAN traffic, allowing only necessary communication paths. This prevents compromised IoT devices from accessing sensitive services and limits lateral movement during security incidents.
What firewall rules should I use with nftables or OPNsense in networking?
networking covers firewall configuration across nftables, OPNsense, and pfSense. Start with a default-deny policy, then explicitly allow required traffic by source, destination, and port. For nftables, define tables and chains for ingress/egress filtering. In OPNsense, use the GUI to create rules tied to interfaces and VLANs. Apply stateful inspection to track connections and block unsolicited inbound traffic. Document your ruleset for auditability.
How does networking help with WireGuard versus Tailscale VPN?
networking covers VPN deployment with both WireGuard and Tailscale. WireGuard offers lower overhead and direct peer-to-peer connections; use it when you control both endpoints and want minimal latency. Tailscale provides easier setup, NAT traversal, and centralized key management through its coordination server; choose it for mixed environments or when simplicity matters. networking guides configuration, key rotation, and access policies for each.
How do I configure DNS filtering and split-horizon resolution with networking?
networking teaches DNS architecture using Pi-hole or AdGuard Home for filtering and blocking. Set up split-horizon DNS to resolve internal hostnames (like services.local) to private IPs for internal clients and external IPs or block them for external queries. Configure your DHCP server to point clients to your DNS resolver, then add blocklists and custom records. This prevents DNS leaks and allows seamless access to self-hosted services.
What does networking cover for reverse proxy and TLS certificate setup?
networking guides reverse proxy configuration with Caddy and Traefik, plus TLS automation via Let's Encrypt and ACME. Set up your reverse proxy to accept external traffic, route it to internal services, and terminate TLS. Use wildcard certificates for multiple subdomains and automate renewal. networking covers certificate pinning, HSTS headers, and integration with Docker for container-based deployments.
How can networking help harden SSH and monitor network security?
networking covers SSH hardening with key-based auth, non-standard ports, and fail2ban to block brute-force attempts. It includes IDS/IPS setup with Suricata and CrowdSec to detect intrusions and anomalies. Add network monitoring with Prometheus and Grafana to track traffic patterns and alert on suspicious activity. These layers detect and respond to threats before they compromise your infrastructure.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
Networking
Security is a non-negotiable default, not an optional add-on. Every network design decision must account for trust boundaries.
References
Extended configuration examples, comparison tables, and detailed patterns for the rules below live in
${CLAUDE_SKILL_DIR}/references/.
vlan-segmentation.md— VLAN design, trunk/access ports, inter-VLAN policy, Layer 2 security: segment table, firewall rule matrix, hardware requirements, DHCP snooping, DAI, port security, L2 attack mitigationfirewall-rules.md— nftables syntax, OPNsense/pfSense hardening, IPv6 firewall rules: chain types/hooks/priorities, connection tracking, NAT, rate limiting, sets/maps, ICMPv6 policy,
(truncated - see the full file via the links below)
File tree — 10 files
plugins/infrastructure/skills/networking/.dev/reference-inventory.json
plugins/infrastructure/skills/networking/SKILL.md
plugins/infrastructure/skills/networking/references/auth-proxies.md
plugins/infrastructure/skills/networking/references/dns-architecture.md
plugins/infrastructure/skills/networking/references/firewall-rules.md
plugins/infrastructure/skills/networking/references/reverse-proxy.md
plugins/infrastructure/skills/networking/references/security-hardening.md
plugins/infrastructure/skills/networking/references/tls-certificates.md
plugins/infrastructure/skills/networking/references/vlan-segmentation.md
plugins/infrastructure/skills/networking/references/vpn-tunnels.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Design and implement secure network architecture with VLANs and firewalls”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Learn to partition your home network into isolated VLANs using UniFi, pfSense/OPNsense, or MikroTik. This guide covers switch trunk and access port configuration, firewall rules, and SSID-to-VLAN mapping to prevent IoT devices, guests, and trusted machines from reaching each other.
A planning and validation framework for homelab network upgrades involving VLANs, local DNS resolvers, firewall rules, and remote access. Work through required inventory, trust zones, and staged migration steps to avoid locking yourself out of critical infrastructure. Includes safety rules, anti-patterns, and a review checklist to confirm your changes won't break management access or recovery paths.
Network Protocol Attacks provides hands-on techniques for exploiting layer 2 and layer 3 protocols to establish man-in-the-middle positions and capture credentials. Covers ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, WPAD abuse, DHCPv6 takeover, VLAN hopping, STP manipulation, DNS spoofing, IPv6 attacks, and IDS/IPS evasion with practical tool workflows and relay chaining.
Deploy a WireGuard VPN server to securely access your home network remotely from phones and laptops. This skill covers server setup on Linux and pfSense, keypair generation, client configuration, and routing choices like split tunneling for home-only traffic or full tunnel for all internet through your home connection.
This skill systematically identifies and resolves IPv6 DNS problems that cause local network clients to bypass direct access and connect through Cloudflare Tunnel with OAuth authentication. It verifies Pi-hole's filter-AAAA configuration, tests IPv6 blocking, clears client DNS caches, and confirms local access works without authentication prompts.
Network Doctor guides you through systematic network diagnostics without risky guesswork. It establishes baseline measurements first, isolates root causes across ISP, Wi-Fi, DNS, MTU, proxy, and background processes, then proposes only reversible fixes with before-and-after verification.
More skills configuring-firewalls (MIT) · Caddy Subdomain Add (unlicensed) · network-attack (MIT) · vpn-setup (MIT) · vpn (Apache-2.0) · firewall-config (MIT)