Self-Hosted Firewall Rule Analysis & Audit: fwtool vs iptables-analyzer vs nftables-audit

Firewall rules are the first line of defense for any self-hosted infrastructure. But as systems grow, firewall configurations accumulate — old rules get added, services change ports, and rarely are rules removed. The result is a bloated, conflicting rule set that’s hard to audit, may contain security gaps, and can even degrade network performance.

Firewall rule analysis and audit tools help you understand, optimize, and secure your firewall configuration. They detect redundant rules, identify overly permissive entries, visualize rule chains, and generate human-readable reports. In this guide, we compare three approaches to firewall rule analysis: fwtool, iptables-analyzer, and nftables-audit frameworks.

The Firewall Rule Audit Problem

Whether you’re managing iptables, nftables, firewalld, or UFW, the core challenges are the same:

• Rule sprawl — hundreds of rules across multiple chains and tables
• Shadowed rules — rules that never match because earlier rules catch the traffic first
• Overly permissive entries — rules that allow more traffic than intended
• Missing documentation — no comments explaining why rules exist
• Configuration drift — rules added ad-hoc without change management

Audit tools address these issues by parsing your firewall configuration, analyzing rule interactions, and generating actionable reports.

fwtool — Unified Firewall Configuration Management

fwtool is a command-line utility designed for managing and analyzing firewall configurations across multiple backends. It provides a unified interface for inspecting, validating, and optimizing firewall rules on Linux systems.

Key Features

• Multi-backend support — works with iptables, nftables, and firewalld
• Rule analysis — detects shadowed, redundant, and conflicting rules
• Configuration export — generates readable reports in multiple formats
• Validation — checks for syntax errors and logical inconsistencies
• Lightweight — single binary with minimal dependencies

Installation

1
2
3
4
5
6
7

# Install from source (Go)
git clone https://github.com/fwtool/fwtool.git
cd fwtool
go build -o fwtool

# Or install via package manager on some distributions
apt install fwtool  # if available in your repo

Usage

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# Analyze current iptables rules
fwtool analyze --backend iptables

# Generate audit report
fwtool audit --format html --output firewall-audit.html

# Check for shadowed rules
fwtool check shadowed --backend iptables

# Optimize rule order
fwtool optimize --backend iptables --dry-run

Docker Deployment

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

version: "3"
services:
  fwtool:
    image: fwtool/fwtool:latest
    container_name: fwtool-audit
    cap_add:
      - NET_ADMIN
    volumes:
      - /etc/iptables:/etc/iptables:ro
      - ./reports:/reports
    command: ["audit", "--backend", "iptables", "--format", "json", "--output", "/reports/audit.json"]
    restart: "no"

Architecture

fwtool operates by reading the current firewall configuration from the kernel (via iptables-save or nft list ruleset), parsing it into an internal rule representation, and then applying various analysis algorithms. The shadow detection algorithm checks if a rule’s matching criteria are fully covered by earlier rules in the same chain. The redundancy detector identifies rules that are exact duplicates or subsets of other rules.

When to Use fwtool

• You manage multiple firewall backends (iptables + nftables)
• You need automated audit reports for compliance
• You want a unified tool for all your firewall analysis needs
• You need rule optimization suggestions

iptables-analyzer — Deep iptables Rule Analysis

The iptables-analyzer is a specialized tool focused exclusively on iptables rule analysis. It provides deep inspection of iptables configurations, including chain visualization, rule interaction analysis, and conflict detection.

Key Features

• iptables-specific — deep understanding of iptables semantics
• Chain visualization — generates visual representations of rule chains
• Conflict detection — identifies rules that contradict each other
• Hit counting analysis — uses iptables packet counters to identify unused rules
• Python-based — easy to extend and customize

Installation

1
2
3
4
5
6
7

# Install via pip
pip install iptables-analyzer

# Or clone from source
git clone https://github.com/iptables-analyzer/iptables-analyzer.git
cd iptables-analyzer
pip install -e .

Usage

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# Analyze current iptables configuration
iptables-analyzer --full

# Show unused rules (based on packet counters)
iptables-analyzer --unused

# Generate conflict report
iptables-analyzer --conflicts

# Export to graphviz for visualization
iptables-analyzer --graphviz > chains.dot

Docker Deployment

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

version: "3"
services:
  iptables-analyzer:
    build: .
    container_name: iptables-analyzer
    cap_add:
      - NET_ADMIN
    volumes:
      - ./analysis-results:/output
    command: ["--full", "--output", "/output/analysis.json"]
    restart: "no"

Architecture

iptables-analyzer reads the output of iptables-save and parses it into a structured representation of tables, chains, and rules. It then applies a series of analysis passes: unused rule detection (checking packet counters), conflict analysis (finding rules with overlapping match criteria but different actions), and reachability analysis (determining which traffic patterns can reach each rule).

The tool’s Python implementation makes it easy to write custom analysis plugins. You can extend it with your own rule checks, such as detecting rules that allow traffic from untrusted networks or identifying rules that don’t follow your organization’s security policy.

When to Use iptables-analyzer

• You exclusively use iptables (not nftables)
• You need deep analysis of iptables rule interactions
• You want visualization of rule chains
• You need to identify unused rules using packet counters

nftables-audit — Modern nftables Rule Auditing

The nftables-audit framework is designed for auditing nftables configurations, the modern successor to iptables. nftables offers a more expressive rule language, better performance, and unified IPv4/IPv6 handling — but also introduces new complexity that audit tools help manage.

Key Features

• nftables-native — understands nftables-specific features (sets, maps, anonymous sets)
• Policy compliance — checks rules against security policy templates
• Performance analysis — identifies rules that may impact packet processing performance
• Diff and change tracking — compares configurations across time
• JSON/YAML output — machine-readable audit results

Installation

1
2
3
4
5
6
7

# Install from source
git clone https://github.com/nftables-audit/nftables-audit.git
cd nftables-audit
pip install -r requirements.txt

# Run audit
python -m nftables_audit --config /etc/nftables.conf

Docker Deployment

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

version: "3"
services:
  nftables-audit:
    build: .
    container_name: nftables-audit
    cap_add:
      - NET_ADMIN
    volumes:
      - /etc/nftables.conf:/etc/nftables.conf:ro
      - ./audit-reports:/reports
    command: ["--config", "/etc/nftables.conf", "--report", "/reports/audit.json"]
    restart: "no"

Architecture

nftables-audit parses the output of nft list ruleset into an abstract syntax tree that represents the full nftables configuration. It then performs several analysis passes:

1. Syntax validation — ensures all rules are syntactically correct
2. Policy compliance — checks rules against a predefined security policy
3. Shadow detection — finds rules that can never match
4. Performance analysis — identifies rules that may cause performance issues (e.g., large sets without hashing)
5. Change detection — compares the current configuration against a baseline

The tool supports policy templates for common security standards, such as CIS benchmarks and custom organizational policies. You define what traffic should be allowed, and the tool checks whether your nftables rules conform.

When to Use nftables-audit

• You’ve migrated to nftables from iptables
• You need policy compliance checking
• You want performance analysis of your firewall rules
• You need to track configuration changes over time

Comparison Table

Common Firewall Rule Issues Found by Auditing

Shadowed Rules

A shadowed rule is one that can never match because an earlier rule in the same chain catches all matching traffic first:

1
2
3
4

# Rule 1: Allow all from 10.0.0.0/8
iptables -A INPUT -s 10.0.0.0/8 -j ACCEPT
# Rule 2: Block 10.0.1.0/24 (SHADOWED — never matches)
iptables -A INPUT -s 10.0.1.0/24 -j DROP

Audit tools detect these automatically and flag them for review.

Overly Permissive Rules

Rules that allow more traffic than intended are a common security risk:

1
2

# This allows ALL traffic from ANY source to port 8080
iptables -A INPUT -p tcp --dport 8080 -j ACCEPT

Policy-based audit tools compare rules against your security requirements and flag violations.

Unused Rules

Rules with zero packet counters have likely been inactive for some time and may be candidates for removal:

1

iptables -L -v -n | grep "0     0"

Tools like iptables-analyzer automate this analysis and generate a list of candidates for cleanup.

Why Self-Host Firewall Rule Auditing?

Running your own firewall audit tools keeps your security analysis private and gives you full control over audit frequency and policy definitions:

• No data exfiltration — firewall rules reveal your network architecture; keeping analysis local prevents exposure
• Continuous auditing — run audits on a schedule (cron) to catch configuration drift immediately
• Custom policies — define security policies specific to your organization, not generic templates
• Compliance automation — generate audit reports for compliance requirements (SOC 2, PCI DSS, HIPAA)
• Cost savings — no per-audit or per-server charges from commercial tools

For related reading, see our self-hosted XDP/eBPF network firewalls guide, network access control comparison, and self-hosted WAF solutions.

FAQ

What is firewall rule auditing?

Firewall rule auditing is the process of analyzing firewall configurations to identify security issues, redundant or shadowed rules, overly permissive entries, and compliance violations. It’s similar to code review but for your network security policies. Regular auditing helps maintain a clean, secure, and performant firewall configuration.

How often should I audit my firewall rules?

For production systems, run automated audits weekly or after every configuration change. For compliance requirements (PCI DSS, SOC 2), quarterly manual reviews are typically required. Automated tools can run daily with minimal overhead, catching configuration drift as soon as it occurs.

What is a shadowed firewall rule?

A shadowed rule is a firewall rule that can never match any traffic because an earlier rule in the same chain already handles all matching packets. Shadowed rules are dead code — they add complexity without providing any security benefit. Audit tools detect shadowed rules by analyzing the matching criteria of each rule in order.

Can audit tools fix my firewall rules automatically?

Most audit tools operate in read-only mode — they identify issues and recommend changes, but don’t modify the firewall configuration automatically. Some tools (like fwtool’s optimize command) can generate optimized rule sets for review, but applying them is a manual process. Automatic changes are risky because firewall misconfiguration can cut off your access to the server.

What’s the difference between iptables and nftables for auditing?

nftables is the modern replacement for iptables, with a more expressive rule language, better performance, and unified IPv4/IPv6 handling. However, nftables rules are more complex (sets, maps, anonymous sets), which makes manual auditing harder. nftables-specific audit tools understand these constructs, while general tools may miss nftables-specific issues.

Do firewall audit tools work with cloud firewalls?

Most audit tools discussed here are designed for Linux host-level firewalls (iptables, nftables). Cloud firewall rules (AWS Security Groups, GCP Firewall Rules, Azure NSGs) use different APIs and data models. Some tools can import cloud firewall configurations via their APIs, but cloud-specific audit tools like Security Hub or cloud-custodian are better suited for cloud-native environments.