Firewall Policy Reviewer

What the saved result shows

In the fabricated IPv4 filter/INPUT policy, two earlier DROP rules cover 75% of the IPv4 source space. A later rule still permits TCP/3389 from the remaining range within the tool's simplified model.

1. Baseline: two review findings. UNRESTRICTED_ADMIN_SOURCE (HIGH) marks the rule's broad stated source. PARTIALLY_SHADOWED_RULE (INFO) identifies earlier terminating rules that overlap some, but not all, of its matches. Inspect the actual report.
2. Proposed follow-up: zero modeled findings. Restrict the later TCP/3389 allow to 192.0.2.0/24, a documentation-only example subnet, and run the same offline analysis. This does not prove the configuration would be safe or reachable in production. Inspect follow-up JSON ↗.

How I approached it

I built a bounded offline reviewer for supported JSON and IPv4 iptables-save rules. It accounts for first-match terminating actions, individual and combined rule shadowing, and partial overlap. The output keeps rule identifiers and earlier-rule references attached to findings.

The key distinction: overlapping earlier drops do not make a later broad allow harmless. Partial overlap is informational; the broad-source review candidate remains visible for an analyst to assess.

Open the evidence or reproduce it

The three primary links above take you directly to the case, the source code, and the rendered report. The artifacts below preserve machine-readable findings and the proposed follow-up.

The HTML report retains the findings from the linked source revision, with portfolio navigation added for accessible viewing. The source project has merged into main; pinned commit links keep this case's original evidence traceable.

Port-range overlap: a separate synthetic example

The published range extension reviews closed numeric destination-port intervals alongside source and destination CIDRs. This independent fabricated fixture tests partial overlap; it is not part of the RDP before/after comparison above.

1. Earlier rule: ACCEPT TCP ports 80–90 from 10.0.0.0/24.
2. Later rule: DROP TCP ports 85–95 from 10.0.0.128/25.
3. Saved result: one PARTIALLY_SHADOWED_RULE candidate. The exact shared traffic is 10.0.0.128/25 → 0.0.0.0/0, TCP 85–90. Ports 91–95 in the later rule remain outside the earlier rule's coverage.

A separate disjoint-range negative control uses 80–84 and 85–95 and produces zero modeled findings. It checks detector behavior; it is not a production remediation. The rendered report preserves the saved finding, with portfolio navigation added. Links pin this example to its own published source snapshot.