Set Default firewalld Zone for Incoming Packets
An XCCDF Rule
Description
To set the default zone to drop for
the built-in default zone which processes incoming IPv4 and IPv6 packets,
modify the following line in
/etc/firewalld/firewalld.conf to be:
DefaultZone=drop
warning alert: Warning
To prevent denying any access to the system, automatic remediation
of this control is not available. Remediation must be automated as
a component of machine provisioning, or followed manually as outlined
above.
Rationale
In firewalld the default zone is applied only after all
the applicable rules in the table are examined for a match. Setting the
default zone to drop implements proper design for a firewall, i.e.
any packets which are not explicitly permitted should not be
accepted.
- ID
- xccdf_org.ssgproject.content_rule_set_firewalld_default_zone
- Severity
- Medium
- References
- Updated