Firewall Rule Review Checklist
A firewall audit checklist for reviewing firewall rules and cloud security groups: find open ports, unused and overly broad rules, and record an owner for each.
- Typical schedule semi-annually
- The checklist 4 sections, 18 items
- Variables
{{environment}}
Use this checklist to review firewall rules, cloud security groups and network access lists, typically twice a year and after major infrastructure changes. Rules pile up: a port opened for a vendor demo, a temporary rule for debugging, an office IP from three moves ago. Each one is a possible way in. The review works for hardware firewalls and for cloud setups such as AWS security groups, Azure network security groups or Hetzner Cloud firewalls.
Who owns it
The network or infrastructure owner runs the review. Application owners confirm whether the rules for their services are still needed. A second person reviews proposed removals on production. Adapt this to your jurisdiction and audit scope; it is a practical checklist, not legal advice.
Common pitfalls
- Rules without a reason. If nobody knows why a rule exists, nobody dares to remove it. Require an owner and a purpose for every rule.
- Reviewing only one layer. A host firewall, a cloud security group and a load balancer may all filter the same traffic. Review the full path.
- Ignoring outbound rules. Unrestricted outbound traffic makes data exfiltration easier.
- Deleting rules in bulk. Remove rules in small batches, during a change window, with a quick way to restore.
- Infrastructure as code drift. If rules live in code, changes made in the console will be overwritten, or will hide from the review.
The checklist: Firewall rule review: {{environment}}
Collect
-
Export all firewall rules, security groups and network ACLs for
{{environment}}Include host firewalls and load balancer listeners, not only the main firewall.
-
Compare the live rules with the infrastructure code and note any drift
-
Collect hit counts or flow logs for each rule, where available
Review each rule
-
Flag rules that allow any source (0.0.0.0/0 or ::/0) to anything other than public web ports
-
Flag administrative ports open to the internet, such as SSH, RDP and database ports
Admin access should go through a VPN, bastion host or identity-aware proxy.
-
Flag rules with broad port ranges or "any" protocol
-
Flag rules with no traffic in the review period
-
Flag rules that reference IPs of former vendors, offices or employees
-
Confirm each remaining rule has a named owner and a documented purpose
-
Review outbound rules and restrict them where the workload allows optional
Clean up
-
Get approval from the rule owner or system owner for each removal or change
-
Apply changes through infrastructure code or the change process
-
Remove rules in small batches and check monitoring after each batch
-
Keep the exported rule set so removed rules can be restored if needed
Verify and record
-
Run an external port scan of
{{environment}}and compare it with the expected open ports -
Document accepted exceptions with an owner and an expiry date
-
File the before and after exports as review evidence
-
Schedule the next review date
Checklist as Markdown
Frequently asked questions
How often should firewall rules be reviewed?
Many organisations review rules every six months, and some standards or customer contracts ask for a fixed interval. Review sooner after major changes, such as a cloud migration or a new office. The important part is that the interval is defined in your policy and you can show the reviews happened.
What should a firewall audit look for?
Look for rules that allow any source, admin ports open to the internet, broad port ranges, unused rules, rules for people or vendors who are gone, and rules without an owner. Also check that the live configuration matches what is documented or defined in code.
How do I safely remove old firewall rules?
Check hit counts or flow logs to confirm the rule is unused, get the owner's approval, then remove a small batch through your change process. Keep the old configuration so you can restore a rule quickly if something breaks.
Updated