Firewall

What This Skill Does

The Firewall skill is a robust administrative tool designed to secure server environments by orchestrating firewall configurations across both operating systems and cloud provider infrastructure. It acts as an expert-in-the-loop, helping you enforce the principle of least privilege by defaulting to a 'deny-all' incoming traffic stance. The skill provides guidance on managing critical ports like SSH, HTTP, and HTTPS, while ensuring that sensitive database ports remain unreachable from the public internet. By abstracting the complexity of cloud provider dashboards (Hetzner, DigitalOcean, AWS, etc.), it enables you to implement defense-in-depth strategies that protect your infrastructure before traffic even hits your server's network interface.

Installation

To integrate this skill into your OpenClaw environment, execute the following command in your terminal:

clawhub install openclaw/skills/skills/ivangdavila/firewall

Ensure that you have the necessary provider API keys or administrative access to your servers before triggering the installation.

Use Cases

• Cloud Hardening: Automating the creation of provider-level firewall groups for new server clusters to ensure immediate protection upon deployment.
• SSH Lockdown: Restricting SSH access (port 22) to specific static IP addresses or known VPN exit nodes to mitigate brute-force attacks.
• Docker Security: Configuring host-level firewalls and reverse-proxy binds to prevent Docker containers from inadvertently exposing internal services to the public.
• Compliance & Auditing: Validating existing firewall rule sets against security best practices and identifying unnecessary open ports.

Example Prompts

1. "Check my current DigitalOcean firewall settings and ensure that port 3306 is not exposed to the public, keeping only 80 and 443 open for web traffic."
2. "I need to restrict SSH access on my Ubuntu server to my office static IP 203.0.113.5. Walk me through the steps to do this without locking me out."
3. "Configure a new firewall policy for my production web servers, setting a default deny policy for all incoming traffic and explicitly allowing HTTP, HTTPS, and WireGuard VPN ports."

Tips & Limitations

Always remember the golden rule of firewall management: Never enable a rule that closes your own access without having a secondary way into the machine. Always verify connectivity in a secondary session before finalizing your rules. Be aware that Docker often circumvents standard iptables rules; use the provided strategies of binding to localhost to secure your containerized applications. Finally, remember that IPv4 and IPv6 rules are often managed independently—ensure both are configured to avoid leaving your server vulnerable to probes on the newer protocol.