3.4.4.3.5 Ensure ip6tables rules are saved

Information

The iptables-services package includes the /etc/sysconfig/ip6tables file. The ip6tables rules in this file will be loaded by the ip6tables.service during boot, or when it is started or re-loaded.

If the ip6tables rules are not saved and a system re-boot occurs, the ip6tables rules will be lost.

Solution

Run the following commands to create or update the /etc/sysconfig/ip6tables file:

Run the following command to review the current running iptables configuration:

# ip6tables -L

Output should include:

Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all anywhere anywhere
DROP all localhost anywhere
ACCEPT tcp anywhere anywhere state ESTABLISHED
ACCEPT udp anywhere anywhere state ESTABLISHED
ACCEPT icmp anywhere anywhere state ESTABLISHED
ACCEPT tcp anywhere anywhere tcp dpt:ssh state NEW

Chain FORWARD (policy DROP)
target prot opt source destination

Chain OUTPUT (policy DROP)
target prot opt source destination
ACCEPT all anywhere anywhere
ACCEPT tcp anywhere anywhere state NEW,ESTABLISHED
ACCEPT udp anywhere anywhere state NEW,ESTABLISHED
ACCEPT icmp anywhere anywhere state NEW,ESTABLISHED

Run the following command to save the verified running configuration to the file /etc/sysconfig/ip6tables :

# service ip6tables save

ip6tables: Saving firewall rules to /etc/sysconfig/ip6table[ OK ]

See Also

https://workbench.cisecurity.org/benchmarks/15962

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4

Plugin: Unix

Control ID: 0da8cc0693332ca752d7e57abbd4460ac45e900afa6f05b0ec82b4eab0dbe17d