Generate optimized firewall rulesets with IDS/IPS integration, zone-based policies, and compliance validation.
You are a network security engineer. Generate a comprehensive firewall ruleset with IDS integration. ## Network Configuration - **Firewall Platform**: [PLATFORM e.g. iptables / nftables / pfSense / Cisco ASA / AWS Security Groups] - **Network Zones**: [ZONES e.g. Internet, DMZ, Internal, Database, Management] - **Services**: [SERVICES e.g. web servers, API servers, databases, mail servers, DNS] - **IDS/IPS**: [IDS e.g. Suricata / Snort / AWS GuardDuty] - **Compliance**: [COMPLIANCE e.g. PCI-DSS / HIPAA / CIS Benchmarks] ## Ruleset Components ### 1. Zone-Based Policy (`zones/`) - Define trust levels for each zone in [ZONES] - Inter-zone traffic matrix: allow/deny/inspect - Default deny policy with explicit allows - Zone-to-zone traffic flow documentation ### 2. Ingress Rules (`rules/ingress.py`) - Public-facing services: HTTP/HTTPS (80/443) to DMZ web servers - Rate limiting: [RATE_LIMIT e.g. 100 conn/min per IP] - Geo-blocking: allow only [COUNTRIES e.g. IN, US, GB] - Known bad IP blocklists (Spamhaus, AbuseIPDB) - SYN flood protection with connection limits - Invalid packet dropping (malformed, fragmented) ### 3. Egress Rules (`rules/egress.py`) - Restrict outbound by zone and service - DNS allowed only to designated resolvers - Block outbound to known C2 domains - Restrict database zone to no internet access - Log all egress for anomaly detection ### 4. Service-Specific Rules (`rules/services/`) For each service in [SERVICES]: - Minimum required port access - Source IP/subnet restrictions - Protocol-specific inspection rules - Connection state tracking (ESTABLISHED, RELATED) - Application-layer filtering where supported ### 5. IDS/IPS Integration (`ids/`) - [IDS] ruleset configuration for [SERVICES] - Custom rules for application-specific attacks - Alert severity levels and notification routing - Automatic blocking rules from IDS alerts - Performance tuning: rule prioritization, hardware offload - Signature update automation ### 6. Management & Monitoring - Firewall rule change management process - Rule audit script: identify redundant, shadowed, overly permissive rules - Traffic analytics dashboard - Compliance verification against [COMPLIANCE] - Automated rule testing with tcpreplay Generate rules in [PLATFORM] syntax with comments explaining each rule's purpose.
Free to copy and use. Compatible with Claude 4 Opus, GPT-5, Gemini 2.5 Pro.
Map your network zones and services. Generate rules for your specific firewall platform. Test in a lab environment before deploying to production. Validate against compliance requirements.
Initial release
Sign in and download this prompt to leave a review.