IT Buddy
Menu
NetworkingSecurityCloudLinux & DevOpsUtilitiesMicrosoft Soon
All toolsMy toolsWhat's newAbout

Azure NSG analyzer

Paste an Azure NSG export to find open ports, hidden conflicts between subnet and NIC rules, and see a traffic diagram.

Runs in your browser · nothing is sentAzureNew

Everything runs in your browser. Nothing is sent anywhere, including subscription IDs, resource names and IP ranges in your export.

How to use

  1. Run "az network nsg show --resource-group <rg> --name <nsg> --output json" (or "az network nsg list" to compare several), or export an ARM template.
  2. Paste the JSON into the tool.
  3. Review the findings, the diagram and the groups table.
  4. If you pasted more than one NSG, check "Conflicts between NSGs" for rules that cancel each other out.

Common scenarios

Finding why traffic is blocked despite an Allow rule

Paste both the subnet NSG and the NIC NSG for a VM to see whether a Deny in one is overriding an Allow in the other.

Auditing a subnet before a security review

Export the NSG and scan for ports open to the internet, redundant rules and duplicates before a scheduled audit.

About this tool

Paste the JSON output of "az network nsg show" or "az network nsg list" (or an ARM template, or the output of "az network nsg rule list"), and the tool checks every custom rule for common problems: ports open to the entire internet, sensitive services exposed without restriction, rules that are shadowed or redundant, and duplicates. The 6 automatic default rules (AllowVNetInBound, DenyAllInBound and similar) are hidden by default since they are not a configuration choice. It draws a diagram of the allowed traffic, lets you check the impact of removing a flagged rule, and when you paste more than one NSG it flags conflicts between them: an Allow in one that is overridden by a Deny in another, which happens because Azure requires both the subnet NSG and the NIC NSG to allow traffic before it gets through. Everything runs locally; the export never leaves your browser.

🔒 Your input stays in your browser and is never sent anywhere.

Frequently asked questions

Does this connect to my Azure subscription?

No. There are no credentials and no API calls. You export the NSG yourself with the Azure CLI, PowerShell or an ARM template and paste the JSON here.

Why are some rules hidden by default?

Azure automatically adds 6 default rules to every NSG (allow VNet traffic, allow the Azure load balancer, deny everything else, for both directions). They are not something you configured, so they are hidden unless you ask to see them, to keep the findings focused on your own rules.

What does a conflict between NSGs mean?

A network interface and its subnet can each have their own NSG, and Azure only lets traffic through if both allow it. If one NSG allows a port and the other denies it, the traffic is blocked in practice, which this tool highlights so you do not waste time debugging the wrong NSG.

How does this handle VirtualNetwork and AzureLoadBalancer tags?

These are Azure-managed groups, not public IP ranges, so they are shown by name on the diagram and never count as "open to the internet". Only "*" and "Internet" are treated as the whole internet.

What to do next

Also useful

  • AWS Security Group analyzerPaste a describe-security-groups export to find open ports, redundant and shadowed rules, see a traffic diagram and the impact of removing a rule.
  • Kubernetes manifest analyzerPaste a Kubernetes manifest to find missing resource limits, risky security settings, overly broad RBAC rules, and get a suggested patch.
  • VPC/subnet plannerPlan subnets inside a VPC or VNet, see usable addresses after provider reservations, catch overlaps, and export Terraform or CloudFormation.
  • Common network portsSearchable list of well-known TCP and UDP ports: SSH, HTTP, HTTPS, RDP, SMB, DNS, databases and more.
  • DMARC analyzerCheck a DMARC record: policy, subdomain policy, pct and report addresses, with a diagram of what receivers do. Look it up in DNS or paste records.
  • IP range to CIDR & IP in network checkConvert an IPv4 range to the minimal list of CIDR blocks and check whether an IP address belongs to a network.

Found a problem or have a suggestion? Tell us