Detections
Analytics

3.4.2.10 Ensure nftables rules are permanent

Information

nftables is a subsystem of the Linux kernel providing filtering and classification of network packets/datagrams/frames.

The nftables service reads the /etc/nftables.conf file for a nftables file or files to include in the nftables ruleset.

A nftables ruleset containing the input, forward, and output base chains allow network traffic to be filtered.

Changes made to nftables ruleset only affect the live system, you will also need to configure the nftables ruleset to apply on boot

Solution

Edit the /etc/nftables.conf file and un-comment or add a line with include <Absolute path to nftables rules file> for each nftables file you want included in the nftables ruleset on boot

Example:

# vi /etc/nftables.conf

Add the line:

include "/etc/nftables.rules"

See Also

https://workbench.cisecurity.org/benchmarks/13007

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4

Plugin: Unix

Control ID: baf73acd3eb04ca3e128955a6cf0fbe0cd2821356929a87ad154cc643fec3a6c