All tools · page 190

Generates extended ACL lines from permit and deny intents with ports and hosts.

Quizzes rule ordering so most-specific entries beat implicit catch-alls.

Explains the implicit deny and why permit order matters.

Generates filter-table INPUT and FORWARD rules from policy intents.

Maps PREROUTING, FORWARD, and POSTROUTING traversal with DNAT and SNAT points.

Generates nftables tables, chains, sets, and rules from intents.

Generates ufw allow, deny, and route syntax from plain intents.

Plans services, ports, and interfaces per firewalld zone.

Checks floating versus interface rule evaluation and ordering.

References zones, interfaces, policy, and rules file syntax.

Steps through a pasted ruleset for hygiene, shadowing, and scope issues.

Tracks stale rule decommissioning with owner and date sign-off rows.

Pairwise-compares pasted rules and flags shadowed or redundant lines.

Generates consistent firewall rule names and comment formats.

Annotates each rule with owner, purpose, and expiry evidence.

Generates zone-pair inspection policies from traffic intents.

Plans DMZ addressing, isolation, and inbound publish sets.

Plans user, server, and management tiers with gateway placement.

Builds a least-privilege allow matrix between workload segments.

Checks ZTNA rollout steps from identity to device posture.

Builds SG rule sets per application tier with port notes.

Compares full-cone, restricted, port-restricted, and symmetric NAT.

Explains loopback NAT symptoms and plan steps for internal access.

Plans SYN cookies, rate limits, and upstream scrubbing steps.