3.4.2.2 Ensure at least one nftables table exists

Information

Tables hold chains. Each table only has one address family and only applies to packets of this family. Tables can have one of five families.

Without a table, nftables will not filter network traffic.

Solution

Run the following command to create a table in nftables

# nft create table inet <table name>

Example if FirewallD is not in use on the system:

# nft create table inet filter

Note: FirewallD uses the table inet firewalld NFTables table that is created when FirewallD is installed.

Impact:

Adding or modifying firewall rules can cause loss of connectivity to the system

See Also

https://workbench.cisecurity.org/benchmarks/12705

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4

Plugin: Unix

Control ID: f2862c6b6c2e3867da60f4b6d3f8973eb4f4876139563a9ecebeaf761775e212