Firewall Rule Analyzer

Import a rule table and find the shadowed, duplicated, overly broad and contradictory rules, with least-privilege suggestions - read-only, nothing is ever pushed to a device.

Runs locally

Everything happens in your browser. What you paste or drop here is never uploaded, logged or stored.

Drop a rule export

CSV rule table, iptables-save output, AWS describe-security-groups JSON or an Azure NSG JSON. Read-only - nothing is ever sent to a device.

Or paste rules

Format

Rules compared exactly, not by eye

Every rule is turned into sets: protocols, source addresses, destination addresses and ports. Addresses use exact IPv4 and IPv6 arithmetic. Rules are then compared in the order the firewall evaluates them.

Shadowed: an earlier rule already matches every packet this rule would, with the opposite action, so this rule can never take effect. Usually a bug.
Redundant or duplicate: an earlier rule already makes the same decision for all of this rule's traffic.
Order-dependent overlap: two rules partly overlap with opposite actions, so for the shared traffic, order decides.

Rules with negation, jumps to other chains, or match conditions the model does not compare (interfaces, connection state) are only compared with rules that have the same conditions. The rest are listed rather than guessed about.

Least privilege, flagged

Independently of order, allow rules are checked for exposure:

everything allowed from anywhere;
every port open;
management and data services open to the internet: SSH, RDP, SMB, databases, Redis, Elasticsearch, Docker and Kubernetes APIs;
/8-sized public ranges;
port ranges wider than a thousand ports;
chains whose default policy is ACCEPT.

Each finding comes with a concrete suggestion. Security groups have no order, so for them only redundancy and exposure are reported.

Frequently asked questions

Does it connect to my firewall or cloud account?

No. It reads the export you paste, in your browser. It cannot change, test or scan anything.

What CSV columns does it understand?

Action (allow/deny/accept/drop/permit), source, destination, protocol, port, and optionally name, direction or chain, enabled, and priority or order. Column names are matched loosely; ports can be lists and ranges.

Why is a rule "not compared"?

Negated matches (! -s) and jumps to user chains change meaning in ways a simple set model cannot represent exactly. Rather than risk a wrong "shadowed", those rules are excluded from ordering checks and named.

References

Related tools

What this tool can and cannot tell you. It reports what is present in the input you provide. It cannot see anything you did not give it, and a clean result means nothing was found in that input - not that the wider system is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.