3.4.2.2 Ensure IPv6 loopback traffic is configured

Information

Configure the loopback interface to accept traffic. Configure all other interfaces to deny traffic to the loopback network (::1).

Rationale:

Loopback traffic is generated between processes on machine and is typically critical to operation of the system. The loopback interface is the only place that loopback network (::1) traffic should be seen, all other interfaces should ignore traffic on this network as an anti-spoofing measure.

Solution

Run the following commands to implement the loopback rules:

# ip6tables -A INPUT -i lo -j ACCEPT

# ip6tables -A OUTPUT -o lo -j ACCEPT

# ip6tables -A INPUT -s ::1 -j DROP

See Also

https://workbench.cisecurity.org/benchmarks/6709

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4

Plugin: Unix

Control ID: e6006fa108a2af9256cd0c0afda7a56853894f1a6f8b648a22e1bbf8966a91fb