Shadowed & redundant rules

Remove rules that do nothing

Lesson 6 of 20 · 12 min · Module 2: Rule sets you can maintain

Rule sets grow by addition. After a few years, part of the list is rules that no packet reaches, and nobody dares to delete them.

Start this lesson →

Free. No installation: you write and run the code in your browser, and it is checked automatically.

By the end, you’ll be able to…

Tell a redundant rule from a shadowed one
Use hit counts as evidence
Shrink a rule set without changing its behaviour

The idea

Two kinds of rule can go without changing anything. A redundant rule allows traffic that an earlier rule already allows. A shadowed rule wants a different action from an earlier rule that matches the same traffic first, so it never takes effect. The lab reports every rule that matched no test packet.

allow tcp from lan to web port 443
allow tcp from 10.0.1.25 to web port 443   # redundant: 10.0.1.25 is in lan
deny tcp from lan to web port 443            # shadowed: rule 1 decides first

01Compare each rule with the ones above it

For every rule ask: is there an earlier rule that already matches all of this traffic? If the earlier rule has the same action, this one is redundant. If the action differs, this one is shadowed, and somebody believed it was doing something.

02Use evidence before deleting

A rule with zero hits over a long period is a candidate, not a verdict: the traffic may be rare, such as a yearly backup. Check the hit counter, read the rule above it, then remove it in a change you can roll back.

03Hit counters on real devices

Every platform counts how often a rule matched. That counter is the first thing to read in a clean-up.

# nftables: counters appear in the listing when rules use "counter"
nft list ruleset

# FortiGate: the policy list in the GUI has Hit Count and Last Used columns

# Huawei USG
display security-policy rule all

Your turn

This policy has six rules, and three of them change nothing. Remove the redundant and shadowed rules so that three rules remain and every test packet gets the same verdict as before.

What the checks look for

Every verdict is the same as before
Three rules remain
Every remaining rule is used
Nothing new is allowed

Try it in the editor →

Take this with you

A shorter rule set with the same behaviour is safer: there is less to misread, and nothing in it pretends to protect you.

Go a little further

Before deleting the shadowed deny, move it to the top and run the lab, to see what it would have done if it had ever been reached.