From cogni-ai-github-ops
Debug the AWF firewall by inspecting Docker containers, analyzing Squid access logs, checking iptables rules, and troubleshooting network issues.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cogni-ai-github-ops:gh-aw-firewall-debugThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
<!-- markdownlint-disable MD013 MD023 MD031 MD032 -->
Use this skill when you need to debug the awf firewall, inspect container state, analyze traffic, or troubleshoot network issues.
blocked egress error.awf-squid, awf-agent) during local firewall debugging.iptables rules to troubleshoot network issues.gh aw compile --verbose).gh aw audit instead of checking the network firewall).awf-squid and awf-agent containers running and consuming resources.github.com implicitly allows api.github.com, leading to confusing TCP_DENIED errors in the Squid log.dmesg for FW_DNS blocks when a domain simply won't resolve, assuming it's a HTTP layer issue.docker exec and grep/awk pipelines to extract logs and states.TCP_DENIED in Squid logs or FW_BLOCKED in dmesg.docker ps | grep awf
docker inspect awf-squid --format='{{.State.Running}}'
docker inspect awf-agent --format='{{.State.ExitCode}}'
Squid proxy container (IP: 172.30.0.10) & Agent execution container (IP: 172.30.0.20).
docker exec awf-squid cat /var/log/squid/access.log
docker exec awf-squid grep "TCP_DENIED" /var/log/squid/access.log | awk '{print $3}' | sort -u
docker exec awf-squid tail -f /var/log/squid/access.log | grep --line-buffered TCP_DENIED
sudo iptables -t filter -L FW_WRAPPER -n -v
docker exec awf-agent iptables -t nat -L OUTPUT -n -v
sudo dmesg | grep "FW_BLOCKED"
docker network inspect awf-net
docker exec awf-agent nc -zv 172.30.0.10 3128
docker exec awf-agent cat /etc/resolv.conf
Debug Mode Workflow:
sudo awf --allow-domains github.com --log-level debug --keep-containers 'curl https://api.github.com'docker ps | grep awfsudo iptables -t filter -L FW_WRAPPER -ndocker rm -f awf-squid awf-agent && docker network rm awf-netDomain blocked unexpectedly: Look at the Host header (3rd column) in /var/log/squid/access.log - it may need a subdomain allowlisted.
DNS resolution failing: Verify DNS allowed in iptables with sudo dmesg | grep "FW_DNS".
docker rm -f awf-squid awf-agent && docker network rm awf-net).FW_WRAPPER lifecycle./tmp/squid-logs-*/access.log instead.npx claudepluginhub cogni-ai-ou/cogni-ai-agentic-collections --plugin cogni-ai-github-opsGuides creation, editing, and verification of skills for AI coding agents using test-driven development with subagent scenarios. Use when authoring or debugging skills.