configuring-firewalls

Name: configuring-firewalls
Author: ancoleman

75installs59forks

How to install configuring-firewalls?

ancoleman/ai-design-components/configuring-firewalls

$npx -y skills add ancoleman/ai-design-components --skill configuring-firewalls

Installs into the current project.

Summary

Configure host-based firewalls (iptables, nftables, UFW) and cloud security groups (AWS, GCP, Azure) with practical rules for common scenarios like web servers, databases, and bastion hosts. Use when exposing services, hardening servers, or implementing network segmentation with

Files · 1

View on GitHub

SKILL.md

1	# Configuring Firewalls
2
3	## Purpose
4
5	Guide engineers through configuring firewalls across host-based (iptables, nftables, UFW), cloud-based (AWS Security Groups, NACLs), and container-based (Kubernetes NetworkPolicies) environments with practical rule examples and safety patterns to prevent lockouts and security misconfigurations.
6
7	## When to Use This Skill
8
9	Trigger Phrases:
10	- "Configure firewall for [server/service]"
11	- "Set up security groups for [AWS resource]"
12	- "Allow port [X] through firewall"
13	- "Block IP address [X.X.X.X]"
14	- "Set up UFW on Ubuntu server"
15	- "Create iptables/nftables rules"
16	- "Configure bastion host firewall"
17	- "Implement egress filtering"
18
19	Common Scenarios:
20	- Initial server setup and hardening
21	- Exposing a new service (web server, API, database)
22	- Implementing network segmentation
23	- Creating bastion host or jump box
24	- Migrating from iptables to nftables
25	- Configuring cloud security groups
26	- Troubleshooting connectivity issues
27
28	## Decision Framework: Which Firewall Tool?
29
30	### Cloud Environments
31
32	AWS:
33	- Instance-level control → Security Groups (stateful, allow-only rules)
34	- Subnet-level enforcement → Network ACLs (stateless, allow + deny rules)
35	- Use both for defense-in-depth
36
37	GCP:
38	- Use VPC Firewall Rules (stateful, priority-based)
39
40	Azure:
41	- Use Network Security Groups (NSGs) (stateful, priority-based)
42
43	### Host-Based Linux Firewalls
44
45	Ubuntu/Debian + Simplicity:
46	- Use UFW (Uncomplicated Firewall) - recommended for most users
47	- Front-end for iptables/nftables with simplified syntax
48
49	RHEL/CentOS/Fedora:
50	- Use firewalld (default on Red Hat ecosystem)
51	- Zone-based configuration with dynamic updates
52
53	Modern Distro + Advanced Control:
54	- Use nftables (best performance, modern standard)
55	- O(log n) performance vs iptables O(n)
56	- Unified IPv4/IPv6/NAT syntax
57
58	Legacy Systems:
59	- Use iptables (migrate to nftables when feasible)
60	- Required for older kernels (< 4.14)
61
62	### Kubernetes/Containers
63
64	- Use NetworkPolicies (requires CNI plugin: Calico, Cilium, Weave)
65	- See references/k8s-networkpolicies.md
66
67	### Stateful vs Stateless
68
69	Stateful (recommended for most cases):
70	- Automatically allows return traffic
71	- Simpler configuration
72	- Examples: Security Groups, UFW, nftables default
73
74	Stateless (specialized use):
75	- Must explicitly allow both directions
76	- Fine-grained control, less state tracking
77	- Examples: Network ACLs, custom nftables rules
78
79	## Quick Start Examples
80
81	### UFW (Ubuntu/Debian)
82
83	```bash
84	# 1. Set defaults
85	sudo ufw default deny incoming
86	sudo ufw default allow outgoing
87
88	# 2. CRITICAL: Allow SSH before enabling (prevent lockout)
89	sudo ufw allow ssh
90	sudo ufw limit ssh # Rate-limit to prevent brute force
91
92	# 3. Allow web traffic
93	sudo ufw allow http # Port 80
94	sudo ufw allow https # Port 443
95
96	# 4. Allow from specific IP (e.g., database access)
97	sudo ufw allow from 192.168.1.100 to any port 5432
98
99	# 5. Enable firewall
100	sudo ufw enable
101
102	# 6. Verify rules
103	sudo ufw status verbose
104	```
105
106	For complete UFW patterns, see references/ufw-patterns.md
107
108	### nftables (Modern Linux)
109
110	```nftables
111	#!/usr/sbin/nft -f
112	# /etc/nftables.conf
113
114	flush ruleset
115
116	table inet filter {
117	chain input {
118	type filter hook input priority 0; policy drop;
119
120	# Accept loopback
121	iif "lo" accept
122
123	# Accept established connections (stateful)
124	ct state established,related accept
125
126	# Drop invalid packets
127	ct state invalid drop
128
129	# Allow SSH
130	tcp dport 22 accept
131
132	# Allow HTTP/HTTPS
133	tcp dport { 80, 443 } accept
134
135	# Log dropped packets
136	log prefix "nftables-drop: " drop
137	}
138
139	chain forward {
140	type filter hook forward priority 0; policy drop;
141	}
142
143	chain output {
144	type filter hook output priority 0; policy accept;
145	}
146	}
147	```
148
149	Apply: `sudo nft -f /etc/nftables.conf`
150	Enable on boot: `sudo systemctl enable nftables`
151
152	For advanced patterns (sets, maps), see references/nftables-patterns.md
153
154	### AWS Security Groups (Terraform)
155
156	```hcl
157	# Web server security group
158	resource "aws_security_group" "web" {
159	name = "web-server-sg"
160	description = "Security group for web servers"
161	vpc_id = aws_vpc.main.id
162
163	# Allow HTTP/HTTPS from anywhere
164	ingress {
165	description = "HTTPS from anywhere"
166	from_port = 443
167	to_port = 443
168	protocol = "tcp"
169	cidr_blocks = ["0.0.0.0/0"]
170	}
171
172	# Allow SSH from bastion only
173	ingress {
174	description = "SSH from bastion"
175	from_port = 22
176	to_port = 22
177	protocol = "tcp"
178	security_groups = [aws_security_group.bastion.

People who liked this also viewed

6 picks

Type

configuring-firewalls

75installs59forks

View on GitHub

How to install configuring-firewalls?

ancoleman/ai-design-components/configuring-firewalls

$npx -y skills add ancoleman/ai-design-components --skill configuring-firewalls

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Configuring Firewalls
2
3	## Purpose
4
5	Guide engineers through configuring firewalls across host-based (iptables, nftables, UFW), cloud-based (AWS Security Groups, NACLs), and container-based (Kubernetes NetworkPolicies) environments with practical rule examples and safety patterns to prevent lockouts and security misconfigurations.
6
7	## When to Use This Skill
8
9	Trigger Phrases:
10	- "Configure firewall for [server/service]"
11	- "Set up security groups for [AWS resource]"
12	- "Allow port [X] through firewall"
13	- "Block IP address [X.X.X.X]"
14	- "Set up UFW on Ubuntu server"
15	- "Create iptables/nftables rules"
16	- "Configure bastion host firewall"
17	- "Implement egress filtering"
18
19	Common Scenarios:
20	- Initial server setup and hardening
21	- Exposing a new service (web server, API, database)
22	- Implementing network segmentation
23	- Creating bastion host or jump box
24	- Migrating from iptables to nftables
25	- Configuring cloud security groups
26	- Troubleshooting connectivity issues
27
28	## Decision Framework: Which Firewall Tool?
29
30	### Cloud Environments
31
32	AWS:
33	- Instance-level control → Security Groups (stateful, allow-only rules)
34	- Subnet-level enforcement → Network ACLs (stateless, allow + deny rules)
35	- Use both for defense-in-depth
36
37	GCP:
38	- Use VPC Firewall Rules (stateful, priority-based)
39
40	Azure:
41	- Use Network Security Groups (NSGs) (stateful, priority-based)
42
43	### Host-Based Linux Firewalls
44
45	Ubuntu/Debian + Simplicity:
46	- Use UFW (Uncomplicated Firewall) - recommended for most users
47	- Front-end for iptables/nftables with simplified syntax
48
49	RHEL/CentOS/Fedora:
50	- Use firewalld (default on Red Hat ecosystem)
51	- Zone-based configuration with dynamic updates
52
53	Modern Distro + Advanced Control:
54	- Use nftables (best performance, modern standard)
55	- O(log n) performance vs iptables O(n)
56	- Unified IPv4/IPv6/NAT syntax
57
58	Legacy Systems:
59	- Use iptables (migrate to nftables when feasible)
60	- Required for older kernels (< 4.14)
61
62	### Kubernetes/Containers
63
64	- Use NetworkPolicies (requires CNI plugin: Calico, Cilium, Weave)
65	- See references/k8s-networkpolicies.md
66
67	### Stateful vs Stateless
68
69	Stateful (recommended for most cases):
70	- Automatically allows return traffic
71	- Simpler configuration
72	- Examples: Security Groups, UFW, nftables default
73
74	Stateless (specialized use):
75	- Must explicitly allow both directions
76	- Fine-grained control, less state tracking
77	- Examples: Network ACLs, custom nftables rules
78
79	## Quick Start Examples
80
81	### UFW (Ubuntu/Debian)
82
83	```bash
84	# 1. Set defaults
85	sudo ufw default deny incoming
86	sudo ufw default allow outgoing
87
88	# 2. CRITICAL: Allow SSH before enabling (prevent lockout)
89	sudo ufw allow ssh
90	sudo ufw limit ssh # Rate-limit to prevent brute force
91
92	# 3. Allow web traffic
93	sudo ufw allow http # Port 80
94	sudo ufw allow https # Port 443
95
96	# 4. Allow from specific IP (e.g., database access)
97	sudo ufw allow from 192.168.1.100 to any port 5432
98
99	# 5. Enable firewall
100	sudo ufw enable
101
102	# 6. Verify rules
103	sudo ufw status verbose
104	```
105
106	For complete UFW patterns, see references/ufw-patterns.md
107
108	### nftables (Modern Linux)
109
110	```nftables
111	#!/usr/sbin/nft -f
112	# /etc/nftables.conf
113
114	flush ruleset
115
116	table inet filter {
117	chain input {
118	type filter hook input priority 0; policy drop;
119
120	# Accept loopback
121	iif "lo" accept
122
123	# Accept established connections (stateful)
124	ct state established,related accept
125
126	# Drop invalid packets
127	ct state invalid drop
128
129	# Allow SSH
130	tcp dport 22 accept
131
132	# Allow HTTP/HTTPS
133	tcp dport { 80, 443 } accept
134
135	# Log dropped packets
136	log prefix "nftables-drop: " drop
137	}
138
139	chain forward {
140	type filter hook forward priority 0; policy drop;
141	}
142
143	chain output {
144	type filter hook output priority 0; policy accept;
145	}
146	}
147	```
148
149	Apply: `sudo nft -f /etc/nftables.conf`
150	Enable on boot: `sudo systemctl enable nftables`
151
152	For advanced patterns (sets, maps), see references/nftables-patterns.md
153
154	### AWS Security Groups (Terraform)
155
156	```hcl
157	# Web server security group
158	resource "aws_security_group" "web" {
159	name = "web-server-sg"
160	description = "Security group for web servers"
161	vpc_id = aws_vpc.main.id
162
163	# Allow HTTP/HTTPS from anywhere
164	ingress {
165	description = "HTTPS from anywhere"
166	from_port = 443
167	to_port = 443
168	protocol = "tcp"
169	cidr_blocks = ["0.0.0.0/0"]
170	}
171
172	# Allow SSH from bastion only
173	ingress {
174	description = "SSH from bastion"
175	from_port = 22
176	to_port = 22
177	protocol = "tcp"
178	security_groups = [aws_security_group.bastion.

People who liked this also viewed

6 picks

Type