Create and Optimize Firewall Rules

Firewall Rules Creator guides the creation, analysis, and maintenance of network access rules. It combines default-deny planning, explicit service allowances, source and destination restrictions, rule consolidation, and documentation of business purpose. Rule order and matching frequency are part of the review, alongside the platform's particular implementation and traffic flow.

The concrete configurations cover Linux iptables, Ubuntu UFW, and AWS Security Groups through Terraform. Broader platform context includes pfSense, Azure NSGs, GCP firewall rules, and enterprise firewalls, but those names do not imply that the same command syntax works across them.

Use the skill when planning host access, limiting database connectivity to application networks, separating network segments, or reviewing an existing ruleset. It also addresses container traffic and Kubernetes networking scenarios.

Treat the supplied rules as examples to adapt to the intended network. The iptables setup flushes existing filter and NAT rules and changes default policies; the UFW setup resets configuration. These operations can disrupt access. Back up the current configuration, test in staging, and retain emergency or break-glass access before applying changes. A sample subnet is not a verified malicious network or the actual address range of a deployment.

Inputs include the platform, interfaces, service ports, allowed origins, destination networks, traffic direction, and business owner. Outputs are platform-specific rule definitions, logging choices, validation steps, and maintained documentation.

The host examples allow loopback and established or related connections, then add SSH, web, and restricted database access. They deny incoming traffic by default while allowing outgoing traffic, so they are not complete outbound-deny policies. UFW offers named application profiles, individual ports, subnet-based access, SSH limiting, and rule comments.

Segmentation patterns allow selected services from a DMZ into an internal network and deny other traffic. Separate restrictions prevent communication between internal segments. The Docker example targets DOCKER-USER; Kubernetes examples address pod ranges and NodePort traffic. Their ranges and exposure need to match the real cluster rather than be copied as universal defaults.

The AWS Terraform pattern restricts web ingress to an application load balancer security group and SSH to a bastion security group. Its egress permits outbound traffic. Other patterns use connection tracking, per-source hash limits, recent-connection tracking, SYN limits, and ipset-backed address lists.

Logging can use a dedicated log-and-drop chain, connection-specific entries, and sampled dropped-packet messages. Inspect the active rules with:

iptables -L INPUT --line-numbers -n -v

Connectivity checks use nc or telnet, path inspection uses traceroute or mtr, and logs can be inspected through syslog or journalctl. UFW provides numbered status output.

The skill serves people maintaining host and network policies who need both rule syntax and an operational review process. Version-controlled configurations, regular audits, backup copies, rule ownership, staging checks, and hit-count review support ongoing cleanup and recovery.