3.5.3.1.3 Ensure firewalld is either not installed or masked with iptables - masked

Information

firewalld (Dynamic Firewall Manager) provides a dynamically managed firewall with support for network/firewall 'zones' to assign a level of trust to a network and its associated connections, interfaces or sources. It has support for IPv4, IPv6, Ethernet bridges and also for IPSet firewall settings. There is a separation of the runtime and permanent configuration options.

Rationale:

Running iptables.service andor ip6tables.service with firewalld.service may lead to conflict and unexpected results.

Solution

Run the following command to remove firewalld

# yum remove firewalld

OR
Run the following command to stop and mask firewalld

# systemctl --now mask firewalld

See Also

https://workbench.cisecurity.org/files/3636

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|CM-6, 800-53|CM-7, 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4

Plugin: Unix

Control ID: 9fc1c4694fceeb1335e6d37f306add1c8fe894621107e39e74a6ef992a77d993