मुफ़्त · नेटवर्क और आईटी इन्फ्रास्ट्रक्चर
फ़ायरवॉल नियम विश्लेषक.
iptables-save आउटपुट या Cisco ACL में छिपे और दोहराए नियम, सब कुछ अनुमति देने वाले नियम, इंटरनेट पर खुली सेवाएँ और जोखिम भरी डिफ़ॉल्ट नीतियाँ जाँचें।
- Rules parsed
- 8
- Chains or ACLs
- 1
- Format
- iptables-save
- Rules with conditions not analysed
- 0 Negations, rate limits, TCP flags, object groups…
Findings
| Severity | Line | Finding | Rule |
|---|---|---|---|
| HIGH | 8 | MySQL (port 3306) is open to any source address. Restrict it to trusted addresses or a VPN. | -A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT |
| HIGH | 10 | Shadowed: line 9 (ACCEPT) matches first, so this DROP never applies. | -A INPUT -s 10.1.0.0/16 -p tcp -m tcp --dport 443 -j DROP |
| MEDIUM | 2 | INPUT policy is ACCEPT with no final drop rule: anything not explicitly blocked is allowed. | :INPUT ACCEPT |
| MEDIUM | 6 | SSH (port 22) is open to any source address. Restrict it to trusted addresses or a VPN. | -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT |
| LOW | 7 | Redundant: line 6 already accepts everything this rule matches. | -A INPUT -s 203.0.113.10/32 -p tcp -m tcp --dport 22 -j ACCEPT |
| LOW | 12 | Redundant: line 11 already accepts everything this rule matches. | -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT |
| INFO | — | No LOG rule in INPUT: dropped traffic leaves no trace for troubleshooting or detection. |
- Static analysis of the text you pasted, done in your browser. Rules with conditions the analyser does not model are never treated as hiding other rules, so it errs on the side of missing findings rather than inventing them.
- Only the iptables filter table is analysed; nat and mangle tables are skipped. Jumps to user chains are treated as non-final.
इस टूल का उपयोग कैसे करें: फ़ायरवॉल नियम विश्लेषक
डेटा दर्ज करें या फ़ाइल चुनें। विकल्प बदलें, परिणाम बनाएं और कॉपी या डाउनलोड करने से पहले उसकी जांच करें।
सीमाएं और समर्थित फ़ॉर्मैट
आपका डेटा आपके उपकरण पर संसाधित होता है।
अंग्रेज़ी में तकनीकी जानकारी
Static analysis of the filter table and standard IOS ACL syntax; nftables, vendor NGFW policies, NAT and object groups are not analysed. Rules with unmodelled conditions are never treated as hiding others. Everything is calculated in your browser; nothing is sent or probed on the network.
Each rule becomes a set of ranges (protocol, addresses, ports, interface, state). A later rule is shadowed or redundant when an earlier final rule covers all its ranges; accepts from any source to sensitive ports are flagged.
In the example, SSH and MySQL are open to any source, a DROP for 10.1.0.0/16 is shadowed by an earlier ACCEPT for 10.0.0.0/8 and a port-80 rule is redundant.