Rule checker - firewall audit

KOM

Usually the use of aliases help make it easier to understand. Is it really the case that the rules are a "mess", or is it that you are having a hard time understanding what they are doing? I doubt you will get much response for the project you propose, but we're more than happy to help you figure out your rules.

kfolman

@KOM:

Usually the use of aliases help make it easier to understand. Is it really the case that the rules are a "mess", or is it that you are having a hard time understanding what they are doing? I doubt you will get much response for the project you propose, but we're more than happy to help you figure out your rules.

Thanks for your answer. But they are a mess. It's not just me who are having troubles understanding them. They're a mess. :)

KOM

I suspect a manual audit is your only option. Validate everything one by one.

johnpoz

How many rules you talking about? So your wanting a tool like nipper? https://www.titania.com/nipperstudio

Yeah I don't think they have support for pf..

kfolman

@johnpoz:

How many rules you talking about? So your wanting a tool like nipper? https://www.titania.com/nipperstudio

Yeah I don't think they have support for pf..

I would say around 5000 rules.

johnpoz

5000?? That just seems insane..

Yeah an audit is in order along with a restructure and simplification most likely…

athurdent

Not exactly what you are looking for, but maybe this will help to identify rules with no hits:
https://forum.pfsense.org/index.php?topic=97925.msg545345#msg545345

capitainbu

Hey Kasper,

I feel your pain when it comes to dealing with a chaotic firewall rule set. Managing a complex network with numerous aliases, subnets, and VLANs can be a real headache. While I haven't come across a specific software that does precisely what you're looking for, I can offer some advice based on my experience.

You might want to consider breaking down the audit into manageable steps. Start by documenting the existing rules, identifying any overlaps or conflicts, and cleaning up unnecessary rules. Then, focus on testing connectivity between specific IP addresses and ports manually. While it's a labor-intensive process, it will give you a thorough understanding of your network's security posture.

Collaborating on developing a software tool for this purpose could be an excellent idea, especially if you have PHP skills. You could create a custom solution tailored to your network's needs. Just remember that such a tool might require ongoing maintenance to stay effective as your network evolves.

mer

if you get to the console, get the output of:
pfctl -sr

That will give you the rules as applied (macros and aliases as expanded), in the order they are evaluated. Keep in mind pf is "last match wins" and the keyword "quick" short circuits the rest of the evaluations on a match.

Nikhiltech

Manual checklist: A list of criteria to manually review your firewall rules against.
Automated tool: A software application that scans your firewall configuration and automatically identifies potential issues.
Compliance with company security policies: Do your rules align with your organization's overall security strategy?
Can you share your firewall configuration file or provide access to the firewall itself?