4.1.7 Ensure ufw default deny firewall policy

Information

A default deny policy on connections ensures that any unconfigured network usage will be rejected.

Note: Any port or protocol without a explicit allow before the default deny will be blocked

With a default accept policy the firewall will accept any packet that is not configured to be denied. It is easier to white list acceptable usage than to black list unacceptable usage.

Solution

Run the following commands to implement a default

deny

policy:

# ufw default deny incoming
# ufw default deny outgoing
# ufw default deny routed

Impact:

Any port and protocol not explicitly allowed will be blocked. The following rules should be considered before applying the default deny.

ufw allow out http
ufw allow out https
ufw allow out ntp # Network Time Protocol
ufw allow out to any port 53 # DNS
ufw allow out to any port 853 # DNS over TLS
ufw logging on

See Also

https://workbench.cisecurity.org/benchmarks/17074

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4

Plugin: Unix

Control ID: 756b11a96609d2ca157f99e952b4a7037746de21abbe0caa73ef6e52492d5e53