Detections
Analytics
4.1.9 Ensure conflicting firewall utilities are not in use with firewalld
Information
Running more than one host-based firewall manager on a system can produce conflicting or unpredictable rule sets. firewalld manages the Linux kernel's netfilter framework through the NFTables backend; a separately managed nftables ruleset (via nftables.service ), the legacy iptables-services saved rules, or ufw running alongside firewalld can override or conflict with the firewalld-managed rules. Only a single host-based firewall utility should be active on the system.When multiple firewall management utilities are active, the effective rule set becomes ambiguous and difficult to audit, and one utility can silently override the protective rules configured in another - weakening or negating the host firewall. Ensuring firewalld is the only active firewall manager keeps the enforced policy deterministic and auditable.
Solution
For any conflicting firewall manager found in the Audit, migrate any required rules into firewalld first, then disable or remove it.Stop, disable, and mask a standalone nftables.service :
# systemctl stop nftables.service
# systemctl --now disable nftables.service
# systemctl mask nftables.service
Remove the iptables-services package if installed:
# dnf remove iptables-services
Remove the ufw package if installed:
# dnf remove ufw
Reload firewalld to apply the firewalld-managed ruleset:
# firewall-cmd --reload
Impact:
If a conflicting utility is currently providing required firewall rules, disabling or removing it without first migrating those rules into firewalld could remove needed access controls. Migrate any required rules into firewalld before disabling other firewall managers.
See Also
Item Details
Audit Name: CIS AlmaLinux OS 9 v3.0.0 L1 Server
Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION
References: 800-53|CA-9, 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4
Plugin: Unix
Control ID: ee90ec56f89a2a29a77c16e19fe2a6903d420a1ba6cbf3cc9f494b08c0067dbb