About Firewall Rule Check
Firewall Rule Check reviews a firewall change request before anyone submits it. You describe a flow (source, destination, protocol and port), and it returns:
- a risk score from 0 to 100,
- the compliance rules the flow breaks, and why,
- what to change to make the request acceptable.
Everything runs in your browser. Nothing you enter leaves it: no accounts, no tracking, no backend.
What it is for
Firewall requests are rejected in security review for the same reasons again and again: any-to-any scope, plaintext protocols such as FTP or Telnet, databases and admin ports reachable from the internet, traffic between zones that should stay apart. Each rejection costs a round trip between the requester and the reviewer, and the ones that slip through become audit findings later.
Firewall Rule Check moves that check to the start of the process:
- Requesters (network, infrastructure and application teams) see the findings a request will trigger, and tighten its scope before they submit it.
- Reviewers (security teams) get a consistent first pass, with each finding tied to a framework control, so their time goes to the requests that need judgement.
- Platform and DevOps teams run the same checks in CI/CD against Terraform and cloud firewall configs, and fail the build on high-risk changes.
What it checks
153 rules: 15 built-in structural checks and 138 compliance rules across six frameworks.
| Framework | Rules |
|---|---|
| PCI-DSS v4.0.1 | 34 |
| CIS Controls v8 | 21 |
| NIST SP 800-53 Rev. 5 | 21 |
| NIS2 Directive | 20 |
| DORA | 17 |
| MITRE ATT&CK | 25 |
Each flow gets a risk score built from four factors (source, destination, port and zone), its framework findings with severities, and an ALLOW, REVIEW or DENY verdict. You can turn frameworks and single rules off to match your environment. See the rule reference and how the score works.
How you use it
- Web app: check up to 20 flows at a time by hand, or import up to 500 rules from CSV, AWS Security Groups, Azure NSG, GCP firewall rules, Kubernetes NetworkPolicy, Terraform plan JSON or Terraform HCL.
- Zones: define up to 10 network zones with their subnets and a zone-to-zone policy (Allow, Review or Deny), so findings reflect your segmentation.
- Reports: export results as a PDF report or CSV, and save your setup as a session file to reuse later.
- CLI for CI/CD: the same engine as an npm package, with JSON, SARIF, CSV, table and PDF output and exit codes for pipeline gates.
npx --yes @cloudsecuritylt/fw-check@2 analyze firewall-rules.csv --fail-on highNew here? Start with the quick start.
What it is not
Firewall Rule Check is a pre-submission checker, not a firewall management platform. It does not connect to firewalls, push rules or replace your change process. Its findings support a review; they are not a compliance audit or certification.
Who builds it
Firewall Rule Check is built and maintained by cloudsecurity.lt as part of its portfolio of security tools. It comes from years of firewall engineering and security architecture work in financial services and critical infrastructure, where the same request mistakes kept reaching review.