Examples
Examples
Try the starting example
- First-match rules: ID, tcp/udp, aligned destination IPv4 CIDR, first port, last port inclusive, allow/deny
- R1,tcp,10.0.0.0/24,80,80,allow R2,tcp,10.0.0.0/25,80,80,deny R3,tcp,10.0.0.0/24,80,81,deny
- Rules fully shadowed by earlier same-protocol rules
- R2
- Rules partly shadowed by earlier rules
- R3
- Effective first-match address/port combinations by rule
- R1: 256; R2: 0; R3: 256
- Overlapping rule pairs with different actions
- R1/R2, R1/R3
- Effective allow address/port combinations
- 256
- Effective deny address/port combinations
- 256
Try another scenario
- First-match rules: ID, tcp/udp, aligned destination IPv4 CIDR, first port, last port inclusive, allow/deny
- R1,tcp,10.0.0.0/24,80,80,deny R2,tcp,10.0.0.0/25,80,80,deny R3,tcp,10.0.0.0/24,80,81,deny
- Rules fully shadowed by earlier same-protocol rules
- R2
- Rules partly shadowed by earlier rules
- R3
- Effective first-match address/port combinations by rule
- R1: 256; R2: 0; R3: 256
- Overlapping rule pairs with different actions
- None
- Effective allow address/port combinations
- 0
- Effective deny address/port combinations
- 512
Calculation method
Calculation method
Rules fully shadowed by earlier same-protocol rules
Subtract the union of all earlier same-protocol address×port rectangles; no remaining rectangle means fully shadowed.
Rules partly shadowed by earlier rules
Some but not all of the rule’s rectangle was already covered.
Effective first-match address/port combinations by rule
Exact remaining IPv4-address count×port count; protocol spaces are disjoint.
Overlapping rule pairs with different actions
List pairwise geometric overlap with differing actions, even if later rule is unreachable.
Effective allow address/port combinations
Sum effective first-match combinations for allow rules.
Effective deny address/port combinations
Sum effective first-match combinations for deny rules; unmatched space has no implied default action.
Symbols and units
- a
- First-match rules: ID, tcp/udp, aligned destination IPv4 CIDR, first port, last port inclusive, allow/deny
Use the units shown. A list keeps the order in which you enter its values. The symbol ^ means “raised to the power of”.
Assumptions & limits
Assumptions & limits
- A bounded symbolic audit of an explicitly ordered destination-IPv4/port TCP/UDP rule subset, not a firewall emulator or security assurance. Source addresses, interfaces, connection state, IPv6 and implicit default rules are excluded. No rules are applied.
Are these inputs private?
These calculations run in your browser. A shared link contains the values you choose to share. Only questions submitted to the separate AI finder are sent to OpenAI.
Further reading
IETF RFC 4632: IPv4 CIDR prefixes; first-match rule semantics are explicitly supplied ↗
Background reading; this does not imply endorsement or independent review of SumFizz.