configuring-firewalls_skill

Overview

This skill shows engineers how to configure host-based firewalls (iptables, nftables, UFW) and cloud security controls (AWS Security Groups, NACLs, GCP, Azure NSGs) with practical, safe rules for web servers, databases, and bastion hosts. It focuses on concrete patterns, safety checks to avoid lockouts, and defense-in-depth recommendations across host, cloud, and container environments. Examples include ready-to-use UFW snippets, nftables rulesets, and Terraform Security Group templates.

How this skill works

The skill inspects the target environment and recommends the appropriate tool (UFW/firewalld/nftables/iptables or cloud provider firewall). It provides step-by-step rule examples, safety checklist items (always allow SSH, test rules, logging), and deployment commands. For cloud resources, it offers Security Group/NACL patterns and Terraform snippets; for containers, it points to Kubernetes NetworkPolicy templates and CNI requirements.

When to use it

• Initial server hardening during provisioning
• Exposing a new service (web, API, or database) to the network
• Creating a bastion/jump host and centralizing SSH access
• Implementing network segmentation or DMZs for multi-tier apps
• Migrating host firewall stacks (iptables → nftables) or adding egress filtering

Best practices

• Start with default deny and explicitly allow required ports/IPs
• Always allow SSH (or ensure console access) before enabling rules
• Use principle of least privilege: avoid 0.0.0.0/0 on sensitive ports
• Enable and monitor firewall logging; keep rules in version control
• Avoid running conflicting tools (don’t run iptables and nftables simultaneously)
• Test rules in staging and verify externally with nmap or service checks

Example use cases

• Basic web server: UFW rules allowing HTTP/HTTPS and SSH only from office or bastion
• Database server: restrict port 5432 to app-tier security group or private subnet
• Bastion host: hardened jump box allowing SSH from corporate IPs, logging enabled, rate-limited SSH
• Egress filtering: block or allow outbound hosts/ports to reduce data exfiltration risk
• Kubernetes: NetworkPolicies to enforce pod-to-pod isolation when using Calico or Cilium