Detections
Analytics

3.4.3.3.4 Ensure ip6tables firewall rules exist for all open ports

Information

Any ports that have been opened on non-loopback addresses need firewall rules to govern traffic.

Note:

 - Changing firewall settings while connected over network can result in being locked out of the system
 - Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well
 - The remediation command opens up the port to traffic from all sources. Consult iptables documentation and set any restrictions in compliance with site policy

Without a firewall rule configured for open ports default firewall policy will drop all packets to these ports.

Solution

For each port identified in the audit which does not have a firewall rule establish a proper rule for accepting inbound connections:

# ip6tables -A INPUT -p <protocol> --dport <port> -m state --state NEW -j ACCEPT

See Also

https://workbench.cisecurity.org/benchmarks/13007

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4

Plugin: Unix

Control ID: c7604921b861421309e2180e3490e4cb4dc6cd17653bb2b6bb21b1d2bb11bfbf