Detections
Analytics

4.1.4 Ensure ufw outgoing default is configured

Information

The default policy for outgoing traffic determines if applications and services running on your server can initiate connections to external networks without requiring specific UFW rules.

With a default deny outgoing policy the firewall will deny ALL outgoing traffic and is a highly restrictive policy that requires the addition of specific allow rules.

Solution

Run the following command to set the default for outgoing to deny :

# ufw default deny outgoing

Warning: Any port or protocol without an explicit allow before the default deny will be blocked.

Impact:

Any port and protocol not explicitly allowed will be blocked. The following rules are an example of some outgoing allow rules that should be considered before applying this default deny.

ufw allow out http
ufw allow out https
ufw allow out ntp # Network Time Protocol
ufw allow out to any port 53 # DNS
ufw allow out to any port 853 # DNS over TLS
ufw logging on

See Also

https://workbench.cisecurity.org/benchmarks/27797

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|CM-7, 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4

Plugin: Unix

Control ID: 0f5b86434708fd996a203a49a57352122b4f18c5011a4d6363a821fea2f04b86