// tool reference · Network & Firewall

Firewall Rule Analyzer Free

iptables / UFW / Cisco ACL / セキュリティグループのルールから危険な開放箇所を監査し、修正方法を提示します。

What it does

Audits a firewall ruleset for openings that expose services to the internet. It parses iptables, UFW, Cisco ACL and cloud security-group syntax, resolves each rule to a service, and ranks what an attacker would reach first. Everything is evaluated in memory — no ruleset is transmitted anywhere or retained.

When to use it

Before exposing a host, to see what the rules actually permit rather than what you intended.
After inheriting infrastructure, to inventory what is already open.
During a review, to produce a defensible list of risky rules with fixes.

Inputs

Field names are the actual form parameters, verified against source.

Field	種類	Required	Notes
rules	textarea	required	The ruleset. iptables-save, UFW status, Cisco ACL or a security-group export.
action	hidden	任意	Set by the form.

What you get back

Per-rule findings with severity, the service inferred from the port, why it matters, and a concrete replacement rule.

活用例

Input

-A INPUT -p tcp --dport 22   -s 0.0.0.0/0 -j ACCEPT
-A INPUT -p tcp --dport 3306 -s 0.0.0.0/0 -j ACCEPT
-A INPUT -p tcp --dport 6379 -s 0.0.0.0/0 -j ACCEPT

Output (abridged)

HIGH      22/tcp SSH open to 0.0.0.0/0
          → restrict source to your admin CIDR; prefer key auth + fail2ban.

CRITICAL  3306/tcp MySQL open to 0.0.0.0/0
          → databases must never face the internet. Bind 127.0.0.1 or restrict CIDR.

CRITICAL  6379/tcp Redis open to 0.0.0.0/0
          → Redis is unauthenticated by default. Bind 127.0.0.1, set requirepass.

How it works

Fully deterministic — a parser plus a service/risk table. No AI call, so it is free, instant, and gives identical output for identical input. For an AI narrative over the same data, use the AI Firewall & Exposure Auditor.

Limits

Read live from the platform configuration.

Rate limit

30 requests / 60s (platform default)

Limitations — what it does なし do

It reads the ruleset you paste, not live state. It cannot see NAT, conntrack, a cloud security group layered above the host, or rule ordering effects from chains you did not include. Confirm anything critical with an external check.

プライバシー

Nothing is stored. The ruleset is parsed in memory and discarded when the response is sent.

Standards

CIS BenchmarksNIST CSF (PR.AC-5)