Grátis · Redes e infraestrutura de TI
Analisador de regras de firewall.
Audite a saída do iptables-save ou ACLs Cisco: regras ocultas ou redundantes, permissões totais, serviços expostos à Internet e políticas arriscadas.
- Rules parsed
- 8
- Chains or ACLs
- 1
- Format
- iptables-save
- Rules with conditions not analysed
- 0 Negations, rate limits, TCP flags, object groups…
Findings
| Severity | Line | Finding | Rule |
|---|---|---|---|
| HIGH | 8 | MySQL (port 3306) is open to any source address. Restrict it to trusted addresses or a VPN. | -A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT |
| HIGH | 10 | Shadowed: line 9 (ACCEPT) matches first, so this DROP never applies. | -A INPUT -s 10.1.0.0/16 -p tcp -m tcp --dport 443 -j DROP |
| MEDIUM | 2 | INPUT policy is ACCEPT with no final drop rule: anything not explicitly blocked is allowed. | :INPUT ACCEPT |
| MEDIUM | 6 | SSH (port 22) is open to any source address. Restrict it to trusted addresses or a VPN. | -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT |
| LOW | 7 | Redundant: line 6 already accepts everything this rule matches. | -A INPUT -s 203.0.113.10/32 -p tcp -m tcp --dport 22 -j ACCEPT |
| LOW | 12 | Redundant: line 11 already accepts everything this rule matches. | -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT |
| INFO | — | No LOG rule in INPUT: dropped traffic leaves no trace for troubleshooting or detection. |
- Static analysis of the text you pasted, done in your browser. Rules with conditions the analyser does not model are never treated as hiding other rules, so it errs on the side of missing findings rather than inventing them.
- Only the iptables filter table is analysed; nat and mangle tables are skipped. Jumps to user chains are treated as non-final.
Como usar esta ferramenta: Analisador de regras de firewall
Insira os dados ou escolha o arquivo. Ajuste as opções, gere o resultado e confira antes de copiar ou baixar.
Limites e formatos aceitos
Seus dados são processados no seu dispositivo.
Notas técnicas em inglês
Static analysis of the filter table and standard IOS ACL syntax; nftables, vendor NGFW policies, NAT and object groups are not analysed. Rules with unmodelled conditions are never treated as hiding others. Everything is calculated in your browser; nothing is sent or probed on the network.
Each rule becomes a set of ranges (protocol, addresses, ports, interface, state). A later rule is shadowed or redundant when an earlier final rule covers all its ranges; accepts from any source to sensitive ports are flagged.
In the example, SSH and MySQL are open to any source, a DROP for 10.1.0.0/16 is shadowed by an earlier ACCEPT for 10.0.0.0/8 and a port-80 rule is redundant.