OverviewHistoryStatsSecurity
npx skills add ...
Documentation
SKILL.md
npx skills add ancoleman/ai-design-components --skill configuring-firewalls
Configure host-based firewalls (iptables, nftables, UFW) and cloud security groups (AWS, GCP, Azure) with practical rules for common scenarios like web servers, databases, and bastion hosts. Use when exposing services, hardening servers, or implementing network segmentation with defense-in-depth strategies.
npx skills add ancoleman/ai-design-components --skill configuring-firewalls
Guide engineers through configuring firewalls across host-based (iptables, nftables, UFW), cloud-based (AWS Security Groups, NACLs), and container-based (Kubernetes NetworkPolicies) environments with practical rule examples and safety patterns to prevent lockouts and security misconfigurations.
Trigger Phrases:
Common Scenarios:
AWS:
GCP:
Azure:
Ubuntu/Debian + Simplicity:
RHEL/CentOS/Fedora:
Modern Distro + Advanced Control:
Legacy Systems:
Stateful (recommended for most cases):
Stateless (specialized use):
For complete UFW patterns, see references/ufw-patterns.md
Apply: sudo nft -f /etc/nftables.conf
Enable on boot: sudo systemctl enable nftables
For advanced patterns (sets, maps), see references/nftables-patterns.md
For Security Groups vs NACLs guide, see references/aws-security-groups.md
Before enabling any firewall:
nmap -Pn <server-ip>ufw limit ssh)Requirements:
UFW:
nftables: See references/nftables-patterns.md for complete example
AWS Security Group: See references/aws-security-groups.md for Terraform module
Requirements:
See references/database-patterns.md for implementation
Purpose: Single hardened entry point for SSH access
See references/bastion-pattern.md for complete implementation
Purpose: Control outbound traffic to prevent data exfiltration
See references/egress-filtering.md for implementation
Track connection state (established, related, new):
No connection tracking:
Layer multiple firewall controls:
Security Groups (AWS): All rules evaluated, most permissive wins Network ACLs (AWS): Sequential evaluation, first match wins nftables/iptables: Sequential, first match wins UFW: Sequential by rule number
Bastion Host Architecture: See references/bastion-pattern.md for single entry point patterns
DMZ (Demilitarized Zone): See references/dmz-pattern.md for network segmentation
Egress Filtering: See references/egress-filtering.md for outbound traffic control
Kubernetes NetworkPolicies: See references/k8s-networkpolicies.md for pod-to-pod isolation
Migrating iptables to nftables: See references/migration-guide.md for conversion process
Cloud Firewall Comparisons:
"I locked myself out via SSH":
Connection timeouts:
sudo ufw status or sudo nft list rulesetss -tuln | grep <port>nmap -Pn <ip> -p <port>/var/log/ufw.log or journalctl -u nftablesAWS: Ephemeral port issues:
Kubernetes pods can't communicate:
kubectl get networkpolicies -n <namespace>For complete troubleshooting guide, see references/troubleshooting.md
❌ Allowing 0.0.0.0/0 on SSH/RDP → Use bastion or VPN ❌ Forgetting to enable firewall → Rules configured but not active ❌ Not testing before enabling → Risk of lockout ❌ Missing ephemeral ports in NACLs → Return traffic blocked ❌ Running iptables + nftables → Conflicts and unpredictable behavior ❌ No logging → Can't debug or audit ❌ Large port ranges → Unnecessary attack surface ❌ Not documenting rules → Future confusion
For infrastructure as code approach, use Terraform (see references/aws-security-groups.md)
Complete working examples available in:
examples/ufw/ - UFW configuration scriptsexamples/nftables/ - nftables rulesetsexamples/iptables/ - iptables rule scriptsexamples/terraform-aws/ - AWS Security Groups and NACLsexamples/terraform-gcp/ - GCP firewall rulesexamples/terraform-azure/ - Azure NSGsexamples/kubernetes/ - NetworkPolicy manifestsRelated Skills:
security-hardening - Firewalls are one component of server hardening. See security-hardening skill for SSH hardening, fail2ban, auditd, and SELinux.
building-ci-pipelines - CI runners need network access to repos and artifact stores. Configure firewall rules for self-hosted runners.
deploying-applications - Applications need firewall rules for service exposure. See deploying-applications for integration.
infrastructure-as-code - Manage firewalls as code with Terraform/CloudFormation. See infrastructure-as-code for IaC best practices.
kubernetes-operations - Advanced K8s networking beyond basic NetworkPolicies. See kubernetes-operations for Services, Ingress, and CNI configuration.
network-architecture - Broader network design patterns. See network-architecture for VPC design, subnets, and routing.
Tool-Specific Guides:
Cloud Provider Guides:
Advanced Patterns:
Support:
#!/usr/sbin/nft -f
# /etc/nftables.conf
flush ruleset
table inet filter {
chain input {
type filter hook input priority 0; policy drop;
# Accept loopback
iif "lo" accept
# Accept established connections (stateful)
ct state established,related accept
# Drop invalid packets
ct state invalid drop
# Allow SSH
tcp dport 22 accept
# Allow HTTP/HTTPS
tcp dport { 80, 443 } accept
# Log dropped packets
log prefix "nftables-drop: " drop
}
chain forward {
type filter hook forward priority 0; policy drop;
}
chain output {
type filter hook output priority 0; policy accept;
}
}# Web server security group
resource "aws_security_group" "web" {
name = "web-server-sg"
description = "Security group for web servers"
vpc_id = aws_vpc.main.id
# Allow HTTP/HTTPS from anywhere
ingress {
description = "HTTPS from anywhere"
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
# Allow SSH from bastion only
ingress {
description = "SSH from bastion"
from_port = 22
to_port = 22
protocol = "tcp"
security_groups = [aws_security_group.bastion.id]
}
# Allow all outbound
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
tags = {
Name = "web-server-sg"
}
}sudo ufw default deny incoming
sudo ufw allow from 203.0.113.0/24 to any port 22 # Office IP
sudo ufw allow http
sudo ufw allow https
sudo ufw enable# Status
sudo ufw status verbose
sudo ufw status numbered
# Add rules
sudo ufw allow <port>/<protocol>
sudo ufw allow from <ip> to any port <port>
sudo ufw limit ssh # Rate limiting
# Delete rules
sudo ufw delete <rule-number>
sudo ufw delete allow 80/tcp
# Logging
sudo ufw logging on
tail -f /var/log/ufw.log
# Reset (disable and remove all rules)
sudo ufw reset# List ruleset
sudo nft list ruleset
# Load config
sudo nft -f /etc/nftables.conf
# Flush all rules
sudo nft flush ruleset
# Add rule dynamically
sudo nft add rule inet filter input tcp dport 8080 accept
# Enable on boot
sudo systemctl enable nftables# List rules
sudo iptables -L -v -n
sudo iptables -L INPUT --line-numbers
# Add rule
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
# Delete rule
sudo iptables -D INPUT <rule-number>
# Save rules
sudo netfilter-persistent save # Debian/Ubuntu
sudo service iptables save # RHEL/CentOS# List security groups
aws ec2 describe-security-groups --group-ids sg-xxxxx
# List NACLs
aws ec2 describe-network-acls --network-acl-ids acl-xxxxx
# Add rule to security group
aws ec2 authorize-security-group-ingress \
--group-id sg-xxxxx \
--protocol tcp \
--port 443 \
--cidr 0.0.0.0/0