skills.rest
Cogni-AI-OU
Cogni-AI-OUOFFICIAL
Explore all skills by this author ā†’
Websiteš•@Cogni_AI_OUGitHub

gh-aw-firewall-debug

Debug AWF firewall egress blocks via Docker, Squid logs, and iptables.

3|1|Updated Apr 12, 2026
Search Tags:#dns resolution#awf firewall#docker network debugging#squid access logs#iptables fw_wrapper#tcp_denied#blocked egress
One-click install
npx skills add https://github.com/Cogni-AI-OU/cogni-ai-agent-skills --skill gh-aw-firewall-debug
Or copy as Structured Prompt for Agentā–¼
Please help me install this Agent Skill.
Skill: gh-aw-firewall-debug
Source: https://github.com/Cogni-AI-OU/cogni-ai-agent-skills/tree/main/gh-aw-firewall-debug
Command: npx skills add https://github.com/Cogni-AI-OU/cogni-ai-agent-skills --skill gh-aw-firewall-debug

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

gh-aw-firewall-debug helps you identify why the AWF (AWF firewall) blocks traffic by inspecting running Docker containers, analyzing Squid access logs, checking iptables rules, and correlating network symptoms like TCP_DENIED and DNS failures.

Core Features & Use Cases

  • Container and network state inspection: Verify whether awf-squid and awf-agent are running as expected and inspect the awf-net Docker network.
  • Squid log-driven traffic diagnosis: Extract and analyze TCP_DENIED entries to pinpoint the blocked destination or missing allowlist coverage (including subdomain issues).
  • iptables and kernel-level block correlation: Inspect FW_WRAPPER and check dmesg for FW_BLOCKED and FW_DNS to distinguish HTTP-layer problems from firewall/DNS issues.
  • Use case: When an agentic workflow run fails with a blocked egress error, use this skill to determine whether the block is due to missing domain/subdomain allowlisting or a DNS/iptables rule mismatch.

Quick Start

Use the skill to debug an AWF egress block by running: sudo awf --allow-domains github.com --log-level debug --keep-containers "curl https://api.github.com" and then inspect the Squid logs and iptables.

Frequently Asked Questions about gh-aw-firewall-debug

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I debug AWF firewall egress blocks showing TCP_DENIED in Squid access logs?ā–¼

Debug AWF firewall egress blocks by inspecting running Docker containers, analyzing Squid access logs for TCP_DENIED entries, and validating iptables rules to pinpoint blocked destinations or missing allowlist coverage.

Why does my agentic workflow fail with blocked egress and DNS resolution errors?ā–¼

Agentic workflows fail with blocked egress when AWF firewall rules mismatch DNS configurations; check dmesg for FW_DNS and FW_BLOCKED kernel signals to distinguish HTTP-layer problems from firewall or DNS issues.

How do I inspect Docker container and network state to troubleshoot AWF traffic blocks?ā–¼

Inspect Docker container and network state by verifying whether awf-squid and awf-agent are running as expected and examining the awf-net Docker network to identify the source of AWF traffic blocks.

What is the best way to correlate iptables FW_wrapper rules with kernel block signals during firewall debugging?ā–¼

Correlate iptables FW_wrapper rules with kernel block signals by inspecting dmesg output for FW_BLOCKED and FW_DNS entries, distinguishing HTTP-layer problems from firewall and DNS rule mismatches.

Do I need sudo access to run AWF firewall debugging with Docker exec and iptables probes?ā–¼

Yes, AWF firewall debugging requires sudo access to run awf commands with allow-domains and log-level debug flags, and to perform non-interactive troubleshooting via docker exec log and iptables probes.

What should I do when AWF firewall debugging leaves behind debug containers and awf-net networks?ā–¼

When AWF firewall debugging leaves behind debug containers and awf-net networks, perform safe cleanup by removing the debug containers and the awf-net Docker network to restore the environment.

Related Skills

Explore More Software Engineering Skillsā†’
githubgithub
123

debug-firewall

Inspect awf-squid and awf-agent containers, Squid logs, and iptables rules to diagnose AWF firewall issues.

Official
Intermediate
githubgithub
123

awf-skill

Enforce domain allowlists and host-level protections for AI agent network access.

Official
Advanced
githubgithub
123

awf-debug-tools

Parse AWF logs and container health to diagnose firewall problems.

Official
Intermediate
MossakaMossaka

awf-debug-tools

Parse Squid logs and diagnose AWF container health status.

Community
Intermediate