Detections
Analytics

4.1.2 Ensure firewalld backend is configured

Information

The FirewallBackend option selects the firewall backend implementation.

Choices are:

 - nftables (default)
 - iptables (iptables, ip6tables, ebtables and ipset)

The iptables backend is deprecated in favor of nftables, the modern default packet-filtering framework that firewalld uses.

Solution

Edit the file /etc/firewalld/firewalld.conf and add or modify the following line:

FirewallBackend=nftables

Impact:

On a system already using the default nftables backend, no change occurs. Changing the backend from iptables requires a firewalld reload and rebuilds the active ruleset using nftables.

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4

Plugin: Unix

Control ID: e67a50efa93cb7eefab17bcce2af4ba51f1afcb3c49520f6c7a5a45562cde6ba