Your files stay on your device

# Firewall rule analyzer

Paste a firewall rule export in CSV, iptables, AWS security group or Azure NSG form and see shadowed, duplicate and overly permissive rules with fixes.

Paste a rule export and press Analyze.

This is static analysis of one pasted export. It cannot connect to a firewall or cloud account, so it does not know what is actually deployed, which rules a stateful engine short-circuits through connection tracking, or what your references and service tags resolve to. Rules with negation, custom-chain jumps, interface or connection-state matches, referenced security groups, or Azure service tags are listed as not compared rather than guessed about. AWS security groups have no rule order, so they get redundancy and exposure checks only. Findings describe the export as written; fixing them still needs a review and a deploy on your side.
OptionsAnalyze

## More network tools

- [Port reference](/network/ports)
- [CIDR overlap check](/network/cidr-check)
- [CloudTrail analyzer](/network/aws-cloudtrail-log-analyzer)
[All network tools](/network)

Was this tool useful?
YesNo

---

Canonical HTML: https://nutter.tools/network/firewall-rule-analyzer
Markdown version: https://nutter.tools/network/firewall-rule-analyzer.md
Plain-text version: https://nutter.tools/network/firewall-rule-analyzer.txt
Agent index: https://nutter.tools/llms.txt