Cloud Firewall Rule Calculator

Measure cloud firewall policy hygiene: quota headroom, shadowed and duplicate rules, any-any exposure and effective rule count per policy.

Inputs

Rules in the policyrules

Rules per policy limitrules

Azure NSG default limit is 1000 rules; GCP allows 2000 firewall rules per VPC network

Allow rulesrules

Deny rulesrules

Rules with any source and any destinationrules

Rules never matched in 90 daysrules

Duplicate or fully overlapping rulesrules

Free priority slots between rulesslots

Azure NSG rule priorities run from 100 to 4096

Rule evaluations per dayevaluations

Policy Hygiene Score

45.8/ 100

Rule Quota Used

32.0%

Rules Remaining

680rules

Dead Rules

42rules

Dead Rule Ratio

13.1%

Effective Rules

278rules

Allow Rule Share

75.0%

Evaluations per Second

486.1eval/s

Verdict

Remove the any-any rules first — every rule below them is decoration

Step by step

Values used
Rules in the policy = 320 rules; Rules per policy limit = 1,000 rules; Allow rules = 240 rules; Deny rules = 80 rules; Rules with any source and any destination = 7 rules; Rules never matched in 90 days = 19 rules; Duplicate or fully overlapping rules = 23 rules; Free priority slots between rules = 120 slots; Rule evaluations per day = 42,000,000 evaluations
Cloud Firewall Rule
Hygiene = 100 − 2 × dead-rule percentage − 4 × any-any rule count − quota overshoot above 80%, clamped to 0–100. Dead rules = shadowed + duplicate.
Effective rule count
Effective rules = total rules − shadowed − duplicate: the count that actually decides whether a packet passes.
Policy Hygiene Score
= 45.8 / 100
Rule Quota Used
= 32.0
Rules Remaining
= 680 rules
Dead Rules
= 42 rules
Dead Rule Ratio
= 13.1
Effective Rules
= 278 rules

How it works

Firewall policies are evaluated in priority order, so a rule that nothing has matched in ninety days is either dead or a latent hole, and a rule matching any source and any destination makes everything beneath it unreachable. The score penalises dead rules proportionally, any-any rules absolutely, and quota pressure only once you pass 80% — the point at which a routine change starts failing. Nobody deletes firewall rules, so policies grow until a change fails at 3am on the quota limit, and by then the any-any rule somebody added 'temporarily' during a migration has been the effective policy for two years.

Formulas

Cloud Firewall Rule

Hygiene = 100 − 2 × dead-rule percentage − 4 × any-any rule count − quota overshoot above 80%, clamped to 0–100. Dead rules = shadowed + duplicate.

deadRatio: Shadowed plus duplicate rules ÷ all rules × 100
anyAnyRules: Rules matching any source and any destination
quotaPenalty: Points lost once rule count passes 80% of the policy limit

Effective rule count

Effective rules = total rules − shadowed − duplicate: the count that actually decides whether a packet passes.

effectiveRules: Rules that can still match traffic
totalRules: Rules configured in the policy

Frequently Asked Questions

How is Cloud Firewall Rule calculated?

Hygiene = 100 − 2 × dead-rule percentage − 4 × any-any rule count − quota overshoot above 80%, clamped to 0–100. Dead rules = shadowed + duplicate. Firewall policies are evaluated in priority order, so a rule that nothing has matched in ninety days is either dead or a latent hole, and a rule matching any source and any destination makes everything beneath it unreachable. The score penalises dead rules proportionally, any-any rules absolutely, and quota pressure only once you pass 80% — the point at which a routine change starts failing.

Why does Cloud Firewall Rule matter?

Nobody deletes firewall rules, so policies grow until a change fails at 3am on the quota limit, and by then the any-any rule somebody added 'temporarily' during a migration has been the effective policy for two years.

What values do I need to enter?

This calculator takes 9 inputs: Rules in the policy, Rules per policy limit, Allow rules, Deny rules, Rules with any source and any destination, Rules never matched in 90 days, Duplicate or fully overlapping rules, Free priority slots between rules, Rule evaluations per day. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

What makes a rule shadowed?

A higher-priority rule already covers its entire match space, so it can never fire. Shadowed rules are dangerous during clean-up: deleting the higher-priority rule silently activates the shadowed one, and if that one is broader you have just opened a hole while doing hygiene work.

Why do priority slots matter?

Azure NSG priorities run 100 to 4096 and evaluation is strictly ordered, so inserting a deny above an existing allow needs a free number between them. Policies numbered 100, 101, 102 have to be fully renumbered to insert anything, which is a change-window-sized problem rather than a five-minute one.

You might also need

Cloud Security Group Calculator Cloud WAF Capacity Calculator Cloud Misconfiguration Calculator