Azure Firewall Policy Optimizer

A web-based tool to analyze and optimize Azure Firewall Policy rules from ARM template JSON.
Merge similar rules, reduce redundancy, and simplify your Azure Firewall configurations.

Features

• Paste or edit your Azure Firewall Policy ARM template JSON.
• Analyze rules for optimization opportunities.
• Preview how rules can be merged.
• One-click optimization: Merge rules and update your JSON.
• Supports NetworkRule, NatRule, and ApplicationRule collections.
• Visual JSON rendering with rainbowJSON.

Usage

1. Open index.html in your browser.
2. Paste your Azure Firewall Policy ARM template JSON into the input box.
3. Select the optimize type (Subnet or FQDN) and direction (Target or Source).
4. Click Analyze.
5. Review the suggested optimizations and preview merged rules.
6. Click Optimize to merge rules and update your JSON.

Expected ARM template format:

{
  "parameters": {
    "ruleCollectionGroups": {
      "value": [
        {
          "name": "rcg-example",
          "properties": {
            "priority": 100,
            "ruleCollections": [
              {
                "name": "rc-network-rules",
                "ruleCollectionType": "FirewallPolicyFilterRuleCollection",
                "priority": 100,
                "action": { "type": "Allow" },
                "rules": [
                  {
                    "name": "allow-web-traffic-1",
                    "ruleType": "NetworkRule",
                    "ipProtocols": ["TCP"],
                    "sourceAddresses": ["10.10.1.0/24"],
                    "destinationAddresses": ["20.30.40.10"],
                    "destinationPorts": ["443"]
                  },
                  {
                    "name": "allow-web-traffic-2",
                    "ruleType": "NetworkRule",
                    "ipProtocols": ["TCP"],
                    "sourceAddresses": ["10.10.2.0/24"],
                    "destinationAddresses": ["20.30.40.10"],
                    "destinationPorts": ["443"]
                  }
                ]
              },
              {
                "name": "rc-nat-rules",
                "ruleCollectionType": "FirewallPolicyNatRuleCollection",
                "priority": 200,
                "action": { "type": "Dnat" },
                "rules": [
                  {
                    "name": "nat-rdp",
                    "ruleType": "NatRule",
                    "ipProtocols": ["TCP"],
                    "sourceAddresses": ["*"],
                    "destinationAddresses": ["52.160.10.10"],
                    "destinationPorts": ["50001"],
                    "translatedAddress": "10.0.10.4",
                    "translatedPort": "3389"
                  }
                ]
              },
              {
                "name": "rc-app-rules",
                "ruleCollectionType": "FirewallPolicyFilterRuleCollection",
                "priority": 300,
                "action": { "type": "Allow" },
                "rules": [
                  {
                    "name": "allow-login",
                    "ruleType": "ApplicationRule",
                    "sourceAddresses": ["10.40.1.0/24"],
                    "targetFqdns": ["login.microsoftonline.com"],
                    "protocols": [{ "protocolType": "Https", "port": 443 }]
                  }
                ]
              }
            ]
          }
        }
      ]
    }
  }
}

Requirements

• Modern web browser (no backend required).
• Internet connection (for CDN dependencies: jQuery, Bootstrap, Bootstrap Icons).

How it works

• The tool groups rules by common source/destination addresses or FQDNs.
• Rules with matching properties (e.g., ports, protocols) are eligible for merging.
• Merged rules are added to the top of the rule collection.
• The tool uses rainbowJSON for pretty-printing and folding JSON.

Development

• All logic is in index.html.
• JSON rendering uses rainbowJSON.
• No build step required.

License

MIT License. See LICENSE.

---

Created by Nguyễn Việt Tùng (Harry)