.

security/network/firewall-config/scripts/firewall-audit.sh

@@ -0,0 +1,91 @@
+#!/bin/bash
+# Firewall Configuration Audit Script
+# Usage: ./firewall-audit.sh
+
+set -euo pipefail
+
+echo "========================================="
+echo "Firewall Configuration Audit"
+echo "========================================="
+echo ""
+
+# Detect firewall type
+if command -v ufw &>/dev/null; then
+    FIREWALL="ufw"
+elif command -v firewall-cmd &>/dev/null; then
+    FIREWALL="firewalld"
+elif command -v nft &>/dev/null; then
+    FIREWALL="nftables"
+else
+    FIREWALL="iptables"
+fi
+
+echo "Detected Firewall: $FIREWALL"
+echo ""
+
+case "$FIREWALL" in
+    ufw)
+        echo "UFW Status:"
+        echo "----------"
+        ufw status verbose
+        echo ""
+        echo "UFW Rules (numbered):"
+        echo "--------------------"
+        ufw status numbered
+        echo ""
+        echo "UFW Application Profiles:"
+        echo "------------------------"
+        ufw app list
+        ;;
+        
+    firewalld)
+        echo "Firewalld Status:"
+        echo "----------------"
+        firewall-cmd --state
+        echo ""
+        echo "Active Zones:"
+        echo "-------------"
+        firewall-cmd --get-active-zones
+        echo ""
+        echo "Default Zone: $(firewall-cmd --get-default-zone)"
+        echo ""
+        echo "All Zone Rules:"
+        echo "--------------"
+        for zone in $(firewall-cmd --get-zones); do
+            echo "--- Zone: $zone ---"
+            firewall-cmd --zone=$zone --list-all 2>/dev/null || true
+            echo ""
+        done
+        ;;
+        
+    nftables)
+        echo "nftables Ruleset:"
+        echo "----------------"
+        nft list ruleset
+        ;;
+        
+    iptables)
+        echo "iptables Rules (Filter):"
+        echo "-----------------------"
+        iptables -L -n -v --line-numbers
+        echo ""
+        echo "iptables Rules (NAT):"
+        echo "--------------------"
+        iptables -t nat -L -n -v --line-numbers 2>/dev/null || true
+        echo ""
+        echo "ip6tables Rules:"
+        echo "---------------"
+        ip6tables -L -n -v --line-numbers 2>/dev/null || true
+        ;;
+esac
+
+echo ""
+echo "========================================="
+echo "Open Ports (listening):"
+echo "========================================="
+ss -tlnp 2>/dev/null || netstat -tlnp
+
+echo ""
+echo "========================================="
+echo "Audit complete"
+echo "========================================="

security/network/firewall-config/scripts/setup-ufw.sh

@@ -0,0 +1,80 @@
+#!/bin/bash
+# UFW Firewall Setup Script
+# Usage: ./setup-ufw.sh [--apply]
+
+set -euo pipefail
+
+APPLY="${1:-}"
+
+if [ "$APPLY" != "--apply" ]; then
+    echo "DRY RUN MODE - showing commands only"
+    echo "Run with --apply to execute"
+    echo ""
+fi
+
+run_cmd() {
+    if [ "$APPLY" == "--apply" ]; then
+        eval "$1"
+    else
+        echo "[DRY RUN] $1"
+    fi
+}
+
+echo "========================================="
+echo "UFW Firewall Setup"
+echo "========================================="
+echo ""
+
+# Reset UFW
+echo "Resetting UFW to defaults..."
+run_cmd "ufw --force reset"
+
+# Set default policies
+echo ""
+echo "Setting default policies..."
+run_cmd "ufw default deny incoming"
+run_cmd "ufw default allow outgoing"
+
+# Essential services
+echo ""
+echo "Allowing essential services..."
+
+# SSH (rate limited)
+run_cmd "ufw limit ssh comment 'SSH with rate limiting'"
+
+# Common services (uncomment as needed)
+echo ""
+echo "Common service rules (customize as needed):"
+
+# Web server
+# run_cmd "ufw allow 80/tcp comment 'HTTP'"
+# run_cmd "ufw allow 443/tcp comment 'HTTPS'"
+
+# Database (restrict to specific IPs)
+# run_cmd "ufw allow from 10.0.0.0/8 to any port 5432 comment 'PostgreSQL from internal'"
+# run_cmd "ufw allow from 10.0.0.0/8 to any port 3306 comment 'MySQL from internal'"
+
+# Application ports
+# run_cmd "ufw allow 8080/tcp comment 'Application'"
+
+# Enable logging
+echo ""
+echo "Enabling logging..."
+run_cmd "ufw logging medium"
+
+# Enable firewall
+echo ""
+echo "Enabling UFW..."
+run_cmd "ufw --force enable"
+
+# Show status
+echo ""
+echo "Final status:"
+if [ "$APPLY" == "--apply" ]; then
+    ufw status verbose
+fi
+
+echo ""
+echo "========================================="
+echo "Setup complete"
+echo "========================================="