Detections
Analytics

3.4.2.3 Ensure iptables are flushed with nftables

Information

nftables is a replacement for iptables, ip6tables, ebtables and arptables

It is possible to mix iptables and nftables. However, this increases complexity and also the chance to introduce errors. For simplicity flush out all iptables rules, and ensure it is not loaded

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Run the following commands to flush iptables:

For iptables:

# iptables -F

For ip6tables:

# ip6tables -F

See Also

https://workbench.cisecurity.org/benchmarks/13007

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4

Plugin: Unix

Control ID: 64f691c0e29386dbaf1375a0640a4b6efd12300bc6903064a9ac627b90d4c554