Information
Configure the firewall rules for new outbound, and established connections
Rationale:
If rules are not in place for new outbound, and established connections all packets will be dropped by the default policy preventing network usage.
NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
Configure nftables in accordance with site policy. The following commands will implement a policy to allow all outbound connections and all established connections:
# nft add rule inet filter input ip protocol tcp ct state established accept # nft add rule inet filter input ip protocol udp ct state established accept # nft add rule inet filter input ip protocol icmp ct state established accept # nft add rule inet filter output ip protocol tcp ct state new,related,established accept # nft add rule inet filter output ip protocol udp ct state new,related,established accept # nft add rule inet filter output ip protocol icmp ct state new,related,established accept