Detections
Analytics

3.4.2.4 Ensure a nftables table exists

Information

Tables hold chains. Each table only has one address family and only applies to packets of this family. Tables can have one of five families.

nftables doesn't have any default tables. Without a table being build, nftables will not filter network traffic.

Solution

Run the following command to create a table in nftables

# nft create table inet <table name>

Example:

# nft create table inet filter

Impact:

Adding rules to a running nftables can cause loss of connectivity to the system

See Also

https://workbench.cisecurity.org/benchmarks/13007

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4

Plugin: Unix

Control ID: 6ee687aa431d4a7d0f91901c15be1630d7ae7d5662904e7b2be87dbcc22bceef