Detections
Analytics

4.1.8 Configure firewall to drop all traffic

Information

firewalld should be set to deny all traffic by default.

A deny all policy is used to achieve a strong security posture by reducing attack surface by blocking any incoming or outgoing traffic not explicitly permitted.

Solution

Run the following to set the drop zone as the default.

# firewall-cmd --set-default-zone=drop

Reload firewalld for changes to take effect

# firewall-cmd --reload

Impact:

Configuring firewalld to utilize a default policy of denying all traffic will effectively halt all communication not explicitly allowed.

Note: Configuration of a live systems firewall directly over a remote connection will often result in being locked out. It is advised to have a known good firewall configuration set to run on boot and to configure an entire firewall structure in a script that is then run and tested before saving to boot.

See Also

https://workbench.cisecurity.org/benchmarks/26236

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7, 800-53|SC-7(12)

Plugin: Unix

Control ID: e5bfa30251a27d4e140287fd7358a7df0c6ed9aad7ac8613ee323fdc463002e9