Firewall Rule Audit Tool for Small Business Firewalls
Build a tool that imports firewall rule sets from OPNsense and Cisco ACLs, finds shadowed, redundant, overly broad and unused rules, and produces a clear audit report with suggested fixes. It turns years of rule clutter into a policy someone can reason about. A network security final year project grounded in well-known research on firewall policy anomalies.
Intermediate
A small team, or one strong student willing to learn something new.1 semester · 2 students
8 to ship
4 optional extrasSuggested stack
What you should ship
- Importers for OPNsense rule exports and Cisco IOS extended ACLs into one common rule model
- Detection of shadowed rules (never reachable because an earlier rule matches first)
- Detection of redundant rules and correlated rules with conflicting actions
- Detection of overly broad rules, such as any source to any destination or large port ranges
- Unused rule detection from firewall hit counts or logs over a chosen period
- An audit report per firewall with each finding, the rules involved and a suggested fix
- A test lab with a deliberately messy rule set of at least 150 rules
- An evaluation comparing findings with a manual review
If you have time left
- A what-if checker: given a source, destination and port, show which rule matches and why
- Compare two versions of a rule set and explain what traffic the change allows or blocks
- Support for a third platform such as Linux nftables
- Map rules to the zones and flows in a written policy and flag rules with no justification
The problem: firewalls collect rules nobody understands
Firewall rule sets grow for years. Rules are added during outages and never removed, projects end but their openings stay, and the people who knew why a rule exists move on. The result is hundreds of rules where some can never match, some duplicate others, a few "temporary" any-to-any rules quietly defeat the whole design, and nobody dares delete anything. Auditors and security reviews ask organisations to justify their rules, and small businesses rarely have the tools to do it.
What already exists and the gap
- Tufin, AlgoSec and FireMon offer firewall policy management and auditing for large enterprises, with pricing and complexity to match.
- Batfish, an open source network configuration analysis tool, can analyse ACL and firewall behaviour from configurations, but it needs expertise to use.
- Capirca, an open source project from Google, generates ACLs from a high-level policy rather than auditing existing ones.
- Firewall platforms show rule hit counts, but not structured anomaly reports.
The gap is a simple audit tool for small and mid-sized organisations running open source firewalls such as OPNsense, or Cisco routers with ACLs: import the rules, find the problems, explain them clearly.
Inspiration
Ehab Al-Shaer and Hazem Hamed's paper "Discovery of policy anomalies in distributed firewalls" (IEEE INFOCOM 2004) defined four kinds of rule anomaly, shadowing, generalisation, correlation and redundancy, and showed how to detect them automatically. That taxonomy is still the common way to talk about firewall rule problems, and it gives your project a solid, citable foundation.
What you build
- Network or security engineer: uploads a rule export, gets a report of findings with the rules involved and a suggested fix.
- Manager or auditor: reads a summary: how many rules, how many findings by type, how many rules never used.
Main flows: import, analyse, review findings, mark findings as accepted or fixed, re-run after changes.
The technically interesting part
- A common rule model. Represent rules from different platforms with the same fields: order, action, protocol, source and destination ranges, ports and interface or zone.
- Anomaly detection. Compare rules as sets of packets: a later rule is shadowed if an earlier rule matches everything it matches with a different action, and redundant if the action is the same. Keep it efficient on hundreds of rules.
- Broad rules. Score rules by how much address and port space they open, and flag the riskiest.
- Usage. Use hit counts or firewall logs over a period to find rules that never match, and present them as candidates to review, not automatic deletions.
- Test lab. Build an OPNsense firewall with a deliberately messy rule set and traffic generators, so you can prove findings with real packets.
How to evaluate it
- Accuracy: compare findings with a careful manual review of the lab rule set; report missed and false findings by anomaly type.
- Scale: analysis time for 100, 500 and 2,000 rules.
- Usefulness: ask two or three network students or engineers to fix the lab policy using only your report, and measure how many risky rules remain.
Suggested plan
- Weeks 1 to 3: lab setup, rule export formats, common model.
- Weeks 4 to 7: importers for OPNsense and Cisco ACLs, shadowing and redundancy detection.
- Weeks 8 to 10: correlation, broad-rule scoring, usage analysis.
- Weeks 11 to 13: report and dashboard.
- Weeks 14 to 15: evaluation and write-up.
Path to a product
Managed service providers and IT consultancies look after many small firewalls and need to show clients their policies are clean. An audit tool with importers for the most common small-business firewalls, a clear report and a "what changed" view between audits could be sold per firewall or bundled into security assessments.
Scope warning
The tool must never change a live firewall. Only analyse rule sets you own or have written permission to audit, and treat exported configurations as sensitive, since they describe how a network is protected.
Learn what you need on Sefism
- Network engineering roadmap: ACLs, NAT, stateful firewalls, segmentation and the firewall lab.
- Network engineering cheat sheet: ACL order and wildcard masks, stateful firewalls, next-generation firewalls and segmentation.
- OPNsense: the open source firewall to build your test lab on.
- GNS3: run the firewall and routers with ACLs in one topology.
- Wireshark User's Guide: prove which rule matched with real packets.
Get help with this idea
The common mistake is spending weeks on importers and leaving the analysis thin. Tauseef can help you define the rule model and the evaluation early so anomaly detection is the heart of the project. If you are new here, create a free account first.
Ideas and guidance, not finished projects
These are project ideas and scoping guidance, published free for students to use as a starting point. I do not build, write, or sell final-year projects, and I do not complete coursework for anyone. Take an idea, make it yours, and build it.
Not sure this one fits you?
I help students pick an idea that matches their skills and their deadline, then scope it down until it is finishable. Guidance only, never done for you.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
Follow along
New writing, resources and project ideas land here first.