← Back to all products

Network Security Toolkit

$39

Firewall rules, IDS/IPS configs, network segmentation patterns, VPN setup, and traffic analysis scripts.

📁 27 files

MarkdownShellPythonYAMLNginx

📄 Product Preview

Try the interactive reader and demo tools below, or get the full product with all content unlocked.

📖 Interactive Reader (Free Preview) ⚙ Try Demo Tools 📦 Download Free Sample

📁 File Structure 27 files

network-security-toolkit/ ├── LICENSE ├── README.md ├── docs/ │ └── network-hardening-guide.md ├── examples/ │ └── suricata-alert-sample.txt ├── firewall/ │ ├── iptables-rules.sh │ ├── nftables.conf │ └── segmentation-zones.md ├── free-sample.zip ├── guide/ │ ├── 01-network-security-fundamentals.md │ ├── 02-host-firewall-and-segmentation.md │ ├── 03-ids-ips-with-suricata.md │ ├── 04-vpn-and-remote-access-hardening.md │ └── 05-verification-and-monitoring.md ├── ids/ │ ├── rules/ │ │ ├── emerging-threats-sample.rules │ │ └── local.rules │ └── suricata.yaml ├── index.html ├── scripts/ │ ├── firewall_verify.sh │ └── port_audit.py ├── ssh/ │ ├── ssh-hardening.md │ └── sshd_config ├── tls/ │ ├── nginx-tls.conf │ └── tls-config-guide.md └── vpn/ ├── openvpn/ │ ├── hardening-notes.md │ └── server.conf └── wireguard/ ├── setup-wireguard.sh └── wg0.conf

📖 Documentation Preview README excerpt

Network Security Toolkit

A code- and config-forward kit for hardening a Linux network estate end to end:

default-deny host firewalls (iptables and nftables), network segmentation

patterns, Suricata IDS/IPS rules, hardened WireGuard and OpenVPN, locked-down

SSH and TLS, plus a dependency-free port auditor and firewall verifier to prove

it all works.

Every file is annotated with the why, not just the what. All addresses use

RFC1918 internal ranges and RFC5737 documentation ranges for public examples; no

real keys, hosts, or infrastructure appear anywhere.

Who this is for

Platform/DevOps engineers, SREs, and security engineers responsible for the

network posture of Linux servers — on-prem, cloud VMs, or hybrid. You should be

comfortable on the shell and with basic TCP/IP. The guides start from first

principles; the configs are ready to adapt.

What you get

Host firewalls, two ways: a fully-commented stateful iptables script

and an equivalent atomic nftables ruleset — both default-deny, with SSH

rate-limiting, anti-spoofing, and parallel IPv6 lockdown.

Segmentation patterns: a reference zone model (DMZ/App/Data/Mgmt) with a

concrete inter-zone allow matrix and the nftables rules to enforce it.

IDS/IPS: an annotated Suricata config plus two rule files — tuned

local rules and an Emerging-Threats-style sample set — covering recon, web

attacks, C2, exfil, and lateral movement, mapped to MITRE ATT&CK.

Hardened VPNs: a WireGuard server config + provisioning script and a

defensively-configured OpenVPN server, with a hardening rationale for each.

SSH + TLS hardening: a production sshd_config (key-only, modern crypto)

and a Mozilla-Intermediate nginx TLS config (HSTS, OCSP stapling, security

headers), each with a verification guide.

Verification tooling: a stdlib port auditor (open/closed/filtered, with

high-risk-exposure flags) and a firewall verifier that asserts the

default-deny invariants.

Prerequisites

Tool	Why	Notes
Linux + root	apply firewall/SSH/VPN configs	tested against modern distros
iptables or nftables	host firewall	pick one; both rulesets provided
Suricata ≥ 6	IDS/IPS	`suricata -T` validates the bundled rules
WireGuard or OpenVPN	remote access	choose per `vpn/openvpn/hardening-notes.md`
nginx	TLS termination	config is portable to other terminators
Python ≥ 3.10	the auditor scripts	stdlib only, no `pip install`

The Python tools (port_audit.py) need no external packages — they run on a

locked-down jump host where you can't install nmap.

Quick start

... continues with setup instructions, usage examples, and more.

📄 Code Sample .sh preview

scripts/firewall_verify.sh#!/usr/bin/env bash # ============================================================================= # firewall_verify.sh — sanity-check a live firewall against the intended policy. # ----------------------------------------------------------------------------- # After applying iptables-rules.sh or nftables.conf, this script asserts the # high-level invariants that MUST hold, regardless of which backend you use: # 1. Default INPUT policy is DROP (default-deny). # 2. A stateful established/related accept rule exists. # 3. Loopback is accepted. # 4. SSH is NOT open to the world (source-restricted or rate-limited). # 5. IPv6 is locked down to match IPv4 (no open v6 bypass). # 6. IP forwarding matches expectation (off unless this is a router). # # It auto-detects nftables vs iptables. Read-only: it inspects, never changes. # # Usage: # sudo ./firewall_verify.sh # expect non-router host # EXPECT_ROUTER=1 sudo ./firewall_verify.sh # this host routes between zones # ============================================================================= set -uo pipefail # NB: not -e; we want to run every check and tally failures EXPECT_ROUTER="${EXPECT_ROUTER:-0}" PASS=0 FAIL=0 ok() { printf ' [PASS] %s\n' "$*"; PASS=$((PASS+1)); } bad() { printf ' [FAIL] %s\n' "$*"; FAIL=$((FAIL+1)); } info() { printf '[verify] %s\n' "$*"; } [ "$(id -u)" -eq 0 ] || { echo "Run as root (needs to read firewall tables)." >&2; exit 1; } # --- Detect backend ---------------------------------------------------------- BACKEND="none" if command -v nft >/dev/null 2>&1 && nft list ruleset 2>/dev/null | grep -q 'hook input'; then BACKEND="nft" elif command -v iptables >/dev/null 2>&1; then BACKEND="iptables" fi info "Detected firewall backend: ${BACKEND}" [ "${BACKEND}" = "none" ] && { echo "No active firewall ruleset found." >&2; exit 2; }

Buy Now — $39 Back to Products