3.6.3.8 Ensure nftables rules are permanent

Information

nftables is a subsystem of the Linux kernel providing filtering and classification of network packets/datagrams/frames.

The nftables service reads the /etc/sysconfig/nftables.conf file for a nftables file or files to include in the nftables ruleset.

A nftables ruleset containing the input, forward, and output base chains allow network traffic to be filtered.

Rationale:

Changes made to nftables ruleset only affect the live system, you will also need to configure the nftables ruleset to apply on boot

Solution

Edit the /etc/sysconfig/nftables.conf file and un-comment or add a line with include <Absolute path to nftables rules file> for each nftables file you want included in the nftables ruleset on boot
example:

# vi /etc/sysconfig/nftables.conf

Add the line:

include '/etc/nftables/nftables.rules'

See Also

https://workbench.cisecurity.org/files/2971

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7(12), CSCv7|9.4

Plugin: Unix

Control ID: 824af5a18aa813c22698b4e756bb08435745f64a3af8fb4b10bbfbd4d0215819