Shadowed firewall rule
A shadowed firewall rule is a rule that can never match traffic because a broader rule earlier in the evaluation order already handles every packet it would have caught — making it dead, misleading, and a source of audit noise.
Firewalls evaluate rules in order and act on the first match. A shadowed rule sits beneath a broader rule that already matches all of its traffic, so it never fires. It is dead weight: it implies intent that the firewall does not actually enforce.
Shadowed rules inflate the rulebase, mislead reviewers about real policy, and complicate audits. Policy analysis detects them by reasoning about rule order and scope, so they can be retired safely with a record of why.
See the concept in practice.
OpClerk PolicyManager puts these ideas to work across every firewall vendor — deployed inside your own perimeter.