// tool reference · Network & Firewall

Firewall Exposure Review Assistant Free

iptables、ufw、AWS セキュリティグループのルールを貼り付けると、インターネットに公開されたサービスと危険なポートを見つけ、修正方法を提示します。

Open Firewall Exposure Review Assistant →

What it does

The AI layer over the Firewall Rule Analyzer. It correlates individual rules into an exposure narrative — which combinations compound, what an attacker chains first, and what to fix in what order — rather than listing rules in isolation.

When to use it

You have the deterministic findings and need the "so what" for a report or a stakeholder.
A ruleset is large enough that per-rule output is hard to prioritise.

Inputs

Field names are the actual form parameters, verified against source.

Field	種類	Required	Notes
rules_raw	textarea	required	The ruleset, same formats as the Firewall Rule Analyzer.

What you get back

A prioritised exposure narrative with reasoning and an ordered remediation plan.

活用例

Input

-A INPUT -p tcp --dport 22 -s 0.0.0.0/0 -j ACCEPT
-A INPUT -p tcp --dport 3306 -s 10.0.0.0/8 -j ACCEPT
-A INPUT -j ACCEPT

Output (abridged)

EXPOSURE NARRATIVE

The last rule is the whole story: '-A INPUT -j ACCEPT' accepts
EVERYTHING. The two rules above it are decorative -- an attacker never
reaches them because the catch-all already let them in.

Attack chain:
  1. Any port is reachable. Enumerate freely.
  2. 3306 LOOKS restricted to 10.0.0.0/8. The catch-all overrides it.
  3. SSH on 22 is world-open -- credential attack surface.

FIX ORDER
  1. Default policy DROP, then allow explicitly. This one change
     collapses the entire exposure.
  2. Re-scope 22 to your admin CIDR.
  3. Verify 3306 is then genuinely unreachable from outside.

How it works

The deterministic parser runs first and always produces findings; the AI then explains and prioritises them. If AI is unavailable or the daily budget is spent, you still get the deterministic result.

Limits

Read live from the platform configuration.

Rate limit

6 requests / 10 minutes

Limitations — what it does なし do

It reads rules, not runtime state. It cannot see NAT, conntrack, a cloud security group layered above the host, or a rule your orchestrator injects at boot. Confirm with an external scan.

プライバシー

The ruleset is sent to the AI provider for analysis and is not retained by the platform.

Standards

CIS BenchmarksNIST CSF