Gratuit · Réseau et infrastructure IT
Analyseur de règles de pare-feu.
Auditez une sortie iptables-save ou des ACL Cisco : règles masquées ou redondantes, autorisations totales, services exposés à Internet et politiques risquées.
- Rules parsed
- 8
- Chains or ACLs
- 1
- Format
- iptables-save
- Rules with conditions not analysed
- 0 Negations, rate limits, TCP flags, object groups…
Findings
| Severity | Line | Finding | Rule |
|---|---|---|---|
| HIGH | 8 | MySQL (port 3306) is open to any source address. Restrict it to trusted addresses or a VPN. | -A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT |
| HIGH | 10 | Shadowed: line 9 (ACCEPT) matches first, so this DROP never applies. | -A INPUT -s 10.1.0.0/16 -p tcp -m tcp --dport 443 -j DROP |
| MEDIUM | 2 | INPUT policy is ACCEPT with no final drop rule: anything not explicitly blocked is allowed. | :INPUT ACCEPT |
| MEDIUM | 6 | SSH (port 22) is open to any source address. Restrict it to trusted addresses or a VPN. | -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT |
| LOW | 7 | Redundant: line 6 already accepts everything this rule matches. | -A INPUT -s 203.0.113.10/32 -p tcp -m tcp --dport 22 -j ACCEPT |
| LOW | 12 | Redundant: line 11 already accepts everything this rule matches. | -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT |
| INFO | — | No LOG rule in INPUT: dropped traffic leaves no trace for troubleshooting or detection. |
- Static analysis of the text you pasted, done in your browser. Rules with conditions the analyser does not model are never treated as hiding other rules, so it errs on the side of missing findings rather than inventing them.
- Only the iptables filter table is analysed; nat and mangle tables are skipped. Jumps to user chains are treated as non-final.
Comment utiliser cet outil: Analyseur de règles de pare-feu
Saisissez ou sélectionnez vos données. Réglez les options, générez le résultat puis vérifiez-le avant de le copier ou de le télécharger.
Limites et formats acceptés
Vos données sont traitées sur votre appareil.
Notes techniques en anglais
Static analysis of the filter table and standard IOS ACL syntax; nftables, vendor NGFW policies, NAT and object groups are not analysed. Rules with unmodelled conditions are never treated as hiding others. Everything is calculated in your browser; nothing is sent or probed on the network.
Each rule becomes a set of ranges (protocol, addresses, ports, interface, state). A later rule is shadowed or redundant when an earlier final rule covers all its ranges; accepts from any source to sensitive ports are flagged.
In the example, SSH and MySQL are open to any source, a DROP for 10.1.0.0/16 is shadowed by an earlier ACCEPT for 10.0.0.0/8 and a port-80 rule is redundant.