3.4.4.2.5 Ensure iptables rules are saved

Information

The iptables-services package includes the /etc/sysconfig/iptables file. The iptables rules in this file will be loaded by the iptables.service during boot, or when it is started or re-loaded.

If the iptables rules are not saved and a system re-boot occurs, the iptables rules will be lost.

Solution

Run the following commands to create or update the /etc/sysconfig/iptables file:

Run the following command to review the current running iptables configuration:

# iptables -L

Output should include:

Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere
DROP all -- loopback/8 anywhere
ACCEPT tcp -- anywhere anywhere state ESTABLISHED
ACCEPT udp -- anywhere anywhere state ESTABLISHED
ACCEPT icmp -- anywhere anywhere state ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh state NEW

Chain FORWARD (policy DROP)
target prot opt source destination

Chain OUTPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere state NEW,ESTABLISHED
ACCEPT udp -- anywhere anywhere state NEW,ESTABLISHED
ACCEPT icmp -- anywhere anywhere state NEW,ESTABLISHED

Run the following command to save the verified running configuration to the file /etc/sysconfig/iptables :

# service iptables save

iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ]

See Also

https://workbench.cisecurity.org/benchmarks/15962

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4

Plugin: Unix

Control ID: 46717cfaaae84a9f8add058e01c386415caa3568823e826cbba28bc1351187e7