Skip to content

Verify ip6tables Enabled if Using IPv6

An XCCDF Rule

Description

The ip6tables service can be enabled with the following manifest:

---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  labels:
    machineconfiguration.openshift.io/role: master
  name: 75-master-ip6tables-enable
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: ip6tables.service
        enabled: true

This will enable the ip6tables service in all the nodes labeled with the "master" role.

Note that this needs to be done for each MachineConfigPool

For more information on how to configure nodes with the Machine Config Operator see the relevant documentation.

Rationale

The ip6tables service provides the system's host-based firewalling capability for IPv6 and ICMPv6.

ID
xccdf_org.ssgproject.content_rule_service_ip6tables_enabled
Severity
Medium
References
Updated