aegis-firewall-edge
Installation
SKILL.md
Scope & Objectives
Audit one running Linux host's network edge (or its config-as-code). Eight domains, in priority order:
- Exposure inventory — every TCP/UDP listener mapped to bound address, service, user; classified internet-reachable vs loopback-only vs link-local; wildcard (
0.0.0.0/[::]) bindings that should be loopback. - Firewall state — which of nftables / iptables / ufw / firewalld is actually active (or none), default policies, rule density per chain.
- Default-deny design — inbound policy drop with explicit allows; drop logging with rate limiting; correct syntax for all three management layers.
- Egress filtering — outbound control for SSRF exfil, reverse shells, data theft; staged log-only rollout.
- IPv6 parity — v6 filtered at least as tightly as v4; NDP/RA permitted.
- L4 rate limiting & brute-force protection — connection/rate meters at the firewall plus fail2ban jails for sshd and nginx auth failures.
- Admin-plane isolation — SSH, DB admin, monitoring agents reachable only from VPN/bastion CIDR; lockout-safe change procedure.
- Layer interplay — Docker DNAT bypass of INPUT rules; cloud security groups vs host firewall double-exposure or false comfort.
Out of scope (cross-references): kernel sysctl knobs (SYN cookies, tcp_syncookies, conntrack limits) → BASE/linux-baseline; TLS termination and proxy headers → TLS; container runtime sandboxing → SANDBOX; log shipping → LOGMON.
Operating rules: