<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Firewall Rule Audits — API Reference

## iptables Commands

```bash
# List all rules with counters
iptables -L -n -v --line-numbers

# List specific chain
iptables -L INPUT -n -v

# Save rules to file
iptables-save > /tmp/iptables-rules.txt

# Restore rules
iptables-restore < /tmp/iptables-rules.txt
```

## nftables Commands

```bash
# List all rules
nft list ruleset

# List specific table
nft list table inet filter

# JSON output
nft -j list ruleset
```

## AWS Security Groups (boto3)

```python
import boto3
ec2 = boto3.client("ec2", region_name="us-east-1")

# List all security groups
sgs = ec2.describe_security_groups()["SecurityGroups"]

# Filter by VPC
sgs = ec2.describe_security_groups(Filters=[
    {"Name": "vpc-id", "Values": ["vpc-12345"]}
])["SecurityGroups"]

# Check inbound rules
for sg in sgs:
    for rule in sg["IpPermissions"]:
        for ip in rule.get("IpRanges", []):
            if ip["CidrIp"] == "0.0.0.0/0":
                print(f"OPEN: {sg['GroupId']} port {rule.get('FromPort')}")
```

## Azure NSG (azure-mgmt-network)

```python
from azure.mgmt.network import NetworkManagementClient
from azure.identity import DefaultAzureCredential

client = NetworkManagementClient(DefaultAzureCredential(), subscription_id)
nsgs = client.network_security_groups.list_all()
for nsg in nsgs:
    for rule in nsg.security_rules:
        if rule.source_address_prefix == "*" and rule.access == "Allow":
            print(f"OPEN: {nsg.name} {rule.name}")
```

## Common Permissive Rule Patterns

| Pattern | Risk | Severity |
|---------|------|----------|
| 0.0.0.0/0 → port 22 | SSH open to internet | Critical |
| 0.0.0.0/0 → port 3389 | RDP open to internet | Critical |
| 0.0.0.0/0 → all ports | Full internet exposure | Critical |
| protocol=all, ACCEPT | No protocol restriction | High |

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | All rules compliant with least privilege |
| 1 | Overly permissive rules detected |
| 2 | Runtime error or insufficient permissions |
