Gratis · Rete e infrastruttura IT
Analizzatore di regole firewall.
Verifica l’output di iptables-save o le ACL Cisco: regole oscurate o ridondanti, permessi totali, servizi esposti a Internet e policy rischiose.
- Rules parsed
- 8
- Chains or ACLs
- 1
- Format
- iptables-save
- Rules with conditions not analysed
- 0 Negations, rate limits, TCP flags, object groups…
Findings
| Severity | Line | Finding | Rule |
|---|---|---|---|
| HIGH | 8 | MySQL (port 3306) is open to any source address. Restrict it to trusted addresses or a VPN. | -A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT |
| HIGH | 10 | Shadowed: line 9 (ACCEPT) matches first, so this DROP never applies. | -A INPUT -s 10.1.0.0/16 -p tcp -m tcp --dport 443 -j DROP |
| MEDIUM | 2 | INPUT policy is ACCEPT with no final drop rule: anything not explicitly blocked is allowed. | :INPUT ACCEPT |
| MEDIUM | 6 | SSH (port 22) is open to any source address. Restrict it to trusted addresses or a VPN. | -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT |
| LOW | 7 | Redundant: line 6 already accepts everything this rule matches. | -A INPUT -s 203.0.113.10/32 -p tcp -m tcp --dport 22 -j ACCEPT |
| LOW | 12 | Redundant: line 11 already accepts everything this rule matches. | -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT |
| INFO | — | No LOG rule in INPUT: dropped traffic leaves no trace for troubleshooting or detection. |
- Static analysis of the text you pasted, done in your browser. Rules with conditions the analyser does not model are never treated as hiding other rules, so it errs on the side of missing findings rather than inventing them.
- Only the iptables filter table is analysed; nat and mangle tables are skipped. Jumps to user chains are treated as non-final.
Come usare questo strumento: Analizzatore di regole firewall
Inserisci i dati o scegli il file. Regola le opzioni, genera il risultato e controllalo prima di copiarlo o scaricarlo.
Limiti e formati supportati
I dati vengono elaborati sul tuo dispositivo.
Note tecniche in inglese
Static analysis of the filter table and standard IOS ACL syntax; nftables, vendor NGFW policies, NAT and object groups are not analysed. Rules with unmodelled conditions are never treated as hiding others. Everything is calculated in your browser; nothing is sent or probed on the network.
Each rule becomes a set of ranges (protocol, addresses, ports, interface, state). A later rule is shadowed or redundant when an earlier final rule covers all its ranges; accepts from any source to sensitive ports are flagged.
In the example, SSH and MySQL are open to any source, a DROP for 10.1.0.0/16 is shadowed by an earlier ACCEPT for 10.0.0.0/8 and a port-80 rule is redundant.