// tool reference · Network & Firewall
AI Firewall & Exposure Auditor Free
Paste iptables, ufw, or AWS security-group rules to find internet-exposed services and risky ports, with fixes.
Open AI Firewall & Exposure Auditor →
What it does
The AI layer over the Firewall Rule Analyzer. It correlates individual rules into an exposure narrative — which combinations compound, what an attacker chains first, and what to fix in what order — rather than listing rules in isolation.
When to use it
- You have the deterministic findings and need the "so what" for a report or a stakeholder.
- A ruleset is large enough that per-rule output is hard to prioritise.
Inputs
Field names are the actual form parameters, verified against source.
| Field | Type | Required | Notes |
|---|---|---|---|
| rules_raw | textarea | required | The ruleset, same formats as the Firewall Rule Analyzer. |
What you get back
A prioritised exposure narrative with reasoning and an ordered remediation plan.
Worked example
Input
-A INPUT -p tcp --dport 22 -s 0.0.0.0/0 -j ACCEPT -A INPUT -p tcp --dport 3306 -s 10.0.0.0/8 -j ACCEPT -A INPUT -j ACCEPT
Output (abridged)
EXPOSURE NARRATIVE
The last rule is the whole story: '-A INPUT -j ACCEPT' accepts
EVERYTHING. The two rules above it are decorative -- an attacker never
reaches them because the catch-all already let them in.
Attack chain:
1. Any port is reachable. Enumerate freely.
2. 3306 LOOKS restricted to 10.0.0.0/8. The catch-all overrides it.
3. SSH on 22 is world-open -- credential attack surface.
FIX ORDER
1. Default policy DROP, then allow explicitly. This one change
collapses the entire exposure.
2. Re-scope 22 to your admin CIDR.
3. Verify 3306 is then genuinely unreachable from outside.
How it works
The deterministic parser runs first and always produces findings; the AI then explains and prioritises them. If AI is unavailable or the daily budget is spent, you still get the deterministic result.
Limits
Read live from the platform configuration.
| Rate limit | 6 requests / 10 minutes |
Limitations — what it does not do
It reads rules, not runtime state. It cannot see NAT, conntrack, a cloud security group layered above the host, or a rule your orchestrator injects at boot. Confirm with an external scan.
Privacy
The ruleset is sent to the AI provider for analysis and is not retained by the platform.
Standards
CIS BenchmarksNIST CSF