Skip to content

[REVIEW] firewall-review: IPv6 parity and service-tag expansion checks #2546

@stmr

Description

@stmr

Skill Being Reviewed

skills/network/firewall-review

Review Focus

The skill covers firewall discovery, default-deny posture, any/any rules, shadowed rules, inbound exposure, outbound exposure, logging, rule owners, and cloud/Kubernetes firewall equivalents. The main gap is dual-stack and provider-managed expansion behavior: IPv6, cloud service tags, prefix lists, and CDN/provider ranges can silently create exposure that is not visible when reviewers inspect only IPv4 CIDRs or friendly rule names.

False Positive Analysis

A broad service tag or prefix list is not always unsafe. Benign examples include:

  • A provider-managed prefix list restricted to a specific private endpoint or storage service.
  • IPv6 disabled at the load balancer, subnet, and host firewall layers.
  • Egress rules to a cloud service tag where the destination service enforces private link, identity, and resource policy controls.

The review should require expansion and effective-path evidence before flagging every service tag as overbroad.

Coverage Gaps

Please add checks for:

  • IPv6 parity: every public IPv4 rule should have an IPv6 review path, and every "IPv4-only" finding should verify IPv6 is disabled or equivalently restricted.
  • Cloud service tag / prefix list expansion: reviewers should inspect what the tag expands to and whether it includes regions/services outside the intended boundary.
  • CDN/WAF/provider range drift: firewall rules based on provider IP ranges need update automation and change evidence.
  • Split enforcement: security group, network ACL, host firewall, Kubernetes network policy, and WAF layers may disagree across IPv4 and IPv6.
  • Outbound allowlists using tags like "Internet", "AzureCloud", or all provider ranges without resource-level constraints.

Edge Cases

  • Some managed services require broad provider tags; the skill should ask for resource policy, identity, private endpoint, or data-plane restriction evidence.
  • IPv6 can be enabled by default on newer cloud templates even when legacy review checklists assume IPv4 only.
  • Prefix lists can be shared across accounts or centrally managed; owner and update controls matter.
  • Shadowed rule analysis should account for expanded tags, not only literal CIDRs.

Remediation Quality

Good remediation should include:

  • Expansion output for service tags/prefix lists at review time.
  • A narrowed destination where feasible.
  • Resource-level controls when network narrowing is impossible.
  • Automation or owner evidence for provider range updates.
  • An IPv6 effective-access test or explicit proof that IPv6 is disabled at every relevant layer.

Comparison To Existing Tools

Cloud firewall analyzers and scanners can report open IPv4 CIDRs, but they often under-report effective access created by service tags, provider prefix lists, and IPv6 defaults. This skill can add value by requiring reviewers to expand abstractions and compare the actual reachable network surface.

Overall Assessment

The skill is already useful for firewall hygiene. Adding IPv6 and service-tag expansion gates would make it stronger for modern cloud networks where the dangerous rule is often hidden behind an abstraction.

Suggested Acceptance Criteria

  • Add explicit IPv6 parity checks.
  • Add service tag / prefix list expansion checks.
  • Add guidance for acceptable broad tags with compensating resource-level controls.
  • Require drift/update evidence for provider-managed IP ranges.

Bounty Info

This is submitted as a skill review bounty claim. Preferred payout: PayPal samik4184@gmail.com.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions