Overview¶
Firevyzer is an analysis tool for firewall ACLs. You give it a policy — or a change to a policy — and it reports the effect on traffic with first-match, order- and shadow-aware semantics, the same way the firewall itself evaluates rules.
The problem with testing one packet at a time¶
A firewall ACL is an ordered list of rules with an implicit trailing default-deny. Whether a packet is allowed depends not just on the rule that matches it, but on every rule above that one having had first claim. That makes ACLs hard to reason about by hand:
- A new rule can silently expose traffic you didn't intend to permit.
- A reordered rule can shadow another, so it never fires.
- "Allow all TCP to this host" plus "drop port 22 to this host" interact in a way that depends entirely on their order.
Spot-checking individual packets — "can 10.2.0.4 reach :443?" — only ever
tells you about the packets you thought to test.
What Firevyzer does instead¶
Firevyzer partitions the entire packet space into traffic classes: concise, symbolic sets of packets that together cover every possible flow. Because the partition is complete by construction, an analysis over the classes is an analysis over every flow — nothing is sampled and nothing is missed.
Each verdict the tool reports is attributed to the specific rule that decides it, so you never have to reverse-engineer why a flow is allowed or denied.
What you can rely on
- Complete — classes cover the whole packet space; no flow is skipped.
- Concise — one symbolic class stands in for countless individual packets.
- Order-aware — verdicts reflect first-match, top-to-bottom evaluation with the implicit default-deny.
Three workflows¶
Firevyzer answers three questions, each built on the same traffic-class engine:
| Question | Workflow |
|---|---|
| "What did this change actually expose or break?" | Diff by class, with provenance |
| "What happens to everything destined for this host or subnet?" | Trace by traffic class |
| "Which rules are dead weight or quietly too permissive?" | Firewall health |
How you use it¶
Firevyzer runs in the browser as a web app. You upload an ACL (or start from a sample), edit it in place, and the analysis panels update reactively as you type. A traffic scope — a host, subnet, protocol, or port — narrows every panel at once so you can focus on the traffic you care about.