About firewall-configuration
A skill for planning, applying, and verifying UFW firewall changes while preserving existing rules and management access. It is intended for operators configuring server network access, with safeguards for SSH reachability, rollback, and IPv4/IPv6 checks.
Key features
- 01Inspect listeners and firewall policy
- 02Add source-restricted management rules
- 03Preview or apply UFW changes
- 04Preserve active rules and save rollback state
- 05Verify access and blocked paths
Use cases
- 01Restrict SSH to approved source ranges
- 02Allow required service ports
- 03Review firewall changes before activation
- 04Recover from a failed firewall update
Install
Copy the command and run it in a terminal.
npx skills add https:/After installing, type/firewall-configurationin Claude Code to confirm it loaded.
Bundled filesreferences/ufw-rules.mdscripts/setup-firewall.sh
Details
From the project READMEFirewall configuration
Configure only the required network paths. Existing active policies and rules must be understood before changing defaults; an allowed SSH rule does not demonstrate that a fresh connection works.
Inventory
- Inspect
ss -ltnup, effective SSH ports,ssh.socketwhere present,ufw status verbose,ufw show added, provider security groups and any container-published ports. - Identify actual management ports and approved source IPv4/IPv6 ranges. With socket activation or a custom daemon invocation, confirm the listener rather than relying on
sshd_configalone. - Check
/etc/default/ufwIPv6 handling. Include relevant external IPv6 tests; IPv4 filtering cannot establish IPv6 isolation. - Record a console recovery path and the current rules/policies. Do not reset UFW as routine troubleshooting.
Read references/ufw-rules.md for source-restricted rules, routing, Docker and recovery.
Configure
Install UFW/iproute2 first if the authorized setup requires them. Preview scripts/setup-firewall.sh:
sudo bash scripts/setup-firewall.sh --ssh-source 203.0.113.10/32 --allow-port 443/tcp --dry-run
For socket/custom listeners, pass each actual port with --ssh-port. Repeat --ssh-source for authorized sources, including IPv6. --public-ssh explicitly chooses access from any source; do not infer that choice from missing information.
Once the rule set and activation are authorized:
sudo bash scripts/setup-firewall.sh --ssh-source 203.0.113.10/32 --allow-port 443/tcp --apply --enable
The helper validates ports/sources/listeners and checks the current SSH client against the proposed source CIDRs before changing rules. If that client is excluded, or its address is unavailable when enabling inactive UFW, it refuses the operation unless --console-recovery-confirmed explicitly attests tested out-of-band recovery. Preserve SSH_CONNECTION through privilege escalation where appropriate; never add the override merely to bypass a failed access check. It adds management access first and snapshots UFW configuration for rollback. It stages deny-incoming/allow-outgoing defaults only on inactive UFW. Existing active defaults and rules are preserved; review unwanted broad allows separately. Without --enable, an inactive firewall remains inactive. Public service flags deliberately allow any source; use manual source-restricted rules for internal databases/services.
Verify and recover
- Verify effective rules and policies, then reconnect through the actual management path. Test approved services and blocked paths from the relevant allowed/denied networks, in both address families where applicable.
- Check container published ports and provider rules independently. Docker's forwarding/NAT path can bypass UFW's host input filtering.
- On command failure, the helper restores its saved files and previous enabled state. For later recovery, use the provider console and printed backup directory; account for service/rule changes made since that snapshot.
- Report configuration, activation and reachability evidence separately. A default-deny policy does not remove pre-existing allow rules, and a running UFW service is not an external exposure test.