Zyxel Config Explorer: see what a USG FLEX H (uOS) config does, in your browser

I keep getting handed USG FLEX H firewalls I didn't set up, and before touching anything I want the basics: which zones and VLANs exist, where traffic is allowed to go, what is reachable from the Internet, and whether the rules contradict each other. The web interface shows policies, objects, NAT, VPN and routing each on its own page, and the exported .conf of a real device can run to thousands of lines.

So I built Zyxel Config Explorer. You drop the exported .conf on the page and get an overview:

• a map of zones by trust level, with interfaces, VLANs and subnets. Click a zone and only its traffic appears: where it can go and what can reach it
• findings sorted by severity, each linked to the rule or object behind it: services reachable from the Internet through NAT, rules that can never match because an earlier one covers them, shadowed rules with the opposite action, NAT rules with no allow rule behind them, unused objects
• rules, routes, objects and NAT in evaluation order, and a zone-to-zone matrix
• a simulator: source IP, destination and port in, the rule that decides out
• a view of what changes if an interface or tunnel goes down
• a diff between two versions of the same config

There is also a read-only view with tables laid out like the uOS interface. The UI is in English and Italian.

The config never leaves your machine. The page needs nothing from the network after it loads, so it works with Wi-Fi off, and dropping a file makes no request. A Content-Security-Policy blocks connections to any other host, and the parser never reads pre-shared keys or passwords. If you would still rather strip them first, the analysis comes out the same:

grep -viE 'pre-shared-key|"psk"|"password"|"secret"|"community"|private-key|passphrase' backup.conf > clean.conf

It is a static analysis of the file: the simulator treats users and schedules as "any" and does not apply NAT, and FQDN and geography objects can't be matched against an IP.

I developed it against a USG FLEX 700H configuration. Other uOS models and firmware versions may use settings the parser doesn't know yet. If something is missing or wrong on yours, an issue on GitHub with the affected lines, anonymised, is the fastest way to get it fixed.

Use it online:
https://rainpwn.github.io/zyxel-config-explorer/

Repository (MIT license):
https://github.com/rainpwn/zyxel-config-explorer