<Group id="network-iptables">
<title>iptables and ip6tables</title>
<description>A host-based firewall called Netfilter is included as
part of the Linux kernel distributed with the system. It is
activated by default. This firewall is controlled by the program
iptables, and the entire capability is frequently referred to by
this name. An analogous program called ip6tables handles filtering
for IPv6.
<br /><br />
Unlike TCP Wrappers, which depends on the network server
program to support and respect the rules written, Netfilter
filtering occurs at the kernel level, before a program can even
process the data from the network packet. As such, any program on
the system is affected by the rules written.
<br /><br />
This section provides basic information about strengthening
the iptables and ip6tables configurations included with the system.
For more complete information that may allow the construction of a
sophisticated ruleset tailored to your environment, please consult
the references at the end of this section.</description>

<Group id="iptables_activation">
<title>Inspect and Activate Default Rules</title>
<description>View the currently-enforced iptables rules by running
the command:
<pre># iptables -nL --line-numbers</pre>
The command is analogous for the ip6tables program.
<br /><br />
If the firewall does not appear to be active (i.e., no rules
appear), activate it and ensure that it starts at boot by issuing
the following commands (and analogously for ip6tables):
<pre># service iptables restart</pre>
The default iptables rules are:
<pre>Chain INPUT (policy ACCEPT)
num  target     prot opt source       destination
1    ACCEPT     all  --  0.0.0.0/0    0.0.0.0/0    state RELATED,ESTABLISHED 
2    ACCEPT     icmp --  0.0.0.0/0    0.0.0.0/0
3    ACCEPT     all  --  0.0.0.0/0    0.0.0.0/0
4    ACCEPT     tcp  --  0.0.0.0/0    0.0.0.0/0    state NEW tcp dpt:22 
5    REJECT     all  --  0.0.0.0/0    0.0.0.0/0    reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT)
num  target     prot opt source       destination
1    REJECT     all  --  0.0.0.0/0    0.0.0.0/0    reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source       destination</pre>
The <tt>ip6tables</tt> default rules are essentially the same.</description>

<Rule id="service_iptables_enabled" severity="medium">
<title>Verify iptables Enabled</title>
<description>
<service-enable-macro service="iptables" />
</description>
<ocil><service-enable-check-macro service="iptables" /></ocil>
<rationale>
The <tt>iptables</tt> service provides the system's host-based firewalling
capability for IPv4 and ICMP.
</rationale>
<ident stig="GEN008520" />
<oval id="service_iptables_enabled" />
<ref nist="ECSC-1" disa="1118" />
</Rule>
</Group><!--<Group id="iptables_activation">-->

<Group id="ruleset_modifications">
<title>Strengthen the Default Ruleset</title>
<description>The default rules can be strengthened. The system
scripts that activate the firewall rules expect them to be defined
in the configuration files iptables and ip6tables in the directory
<tt>/etc/sysconfig</tt>. Many of the lines in these files are similar
to the command line arguments that would be provided to the programs
<tt>/sbin/iptables</tt> or <tt>/sbin/ip6tables</tt> - but some are quite
different.
<br /><br />
The following recommendations describe how to strengthen the
default ruleset configuration file. An alternative to editing this
configuration file is to create a shell script that makes calls to
the iptables program to load in rules, and then invokes service
iptables save to write those loaded rules to
<tt>/etc/sysconfig/iptables.</tt>
<br /><br />
The following alterations can be made directly to
<tt>/etc/sysconfig/iptables</tt> and <tt>/etc/sysconfig/ip6tables</tt>.
Instructions apply to both unless otherwise noted. Language and address
conventions for regular iptables are used throughout this section;
configuration for ip6tables will be either analogous or explicitly
covered.</description>
<warning category="general">The program <tt>system-config-securitylevel</tt>
allows additional services to penetrate the default firewall rules
and automatically adjusts <tt>/etc/sysconfig/iptables</tt>. This program
is only useful if the default ruleset meets your security
requirements. Otherwise, this program should not be used to make
changes to the firewall configuration because it re-writes the
saved configuration file.</warning>

<Rule id="iptables_timestamp_reject_rule" severity="low">
<title>Reject Incoming Timestamp Requests and Replies</title>
<description>To reject incoming timestamp requests and replies,
add or correct the following line in
<tt>/etc/sysconfig/iptables</tt>:
<pre>-I INPUT -p icmp -m icmp --icmp-type timestamp-request -j DROP</pre>
<pre>-I INPUT -p icmp -m icmp --icmp-type timestamp-reply -j DROP</pre>
</description>
<rationale>The processing of (ICMP) timestamp requests increases 
the attack surface of the system.</rationale>
<ident stig="GEN003602" />
<oval id="iptables_timestamp_reject_rule" />
<ref nist="ECSC-1" disa="1551" />
</Rule>

<Rule id="iptables_input_reject_rule" severity="medium">
<title>Add Reject Rule for INPUT Chain.</title>
<description>To set the default policy to DROP (instead of ACCEPT) for
the built-in INPUT chain which processes incoming packets,
add or correct the following line in
<tt>/etc/sysconfig/iptables</tt>:
<pre>:INPUT DROP [0:0]</pre>
</description>
<ocil clause="the default policy for the INPUT chain is not set to DROP">Inspect the iptables configuration to determine
the default policy for the INPUT chain. It should be set to DROP:
<pre> # iptables --list</pre>
</ocil>
<rationale>In <tt>iptables</tt> the default policy is applied only after all
the applicable rules in the table are examined for a match. Setting the
default policy to <tt>DROP</tt> implements proper design for a firewall, i.e.
any packets which are not explicitly permitted should not be
accepted.</rationale>
<ident stig="GEN008540" />
<oval id="iptables_input_reject_rule" />
<ref nist="ECSC-1" disa="1109" />
</Rule>

<Rule id="ip6tables_input_icmpv6_broadcast" severity="medium">
<title>Ignore ICMPv6 Echo Requests On a Broadcast Address.</title>
<description>To configure the system to ignore ICMPv6 echo requests 
on a broadcast address, add or correct the following line in
<tt>/etc/sysconfig/ip6tables</tt>:
<pre>-A INPUT -p icmpv6 -d ff02::1 --icmpv6-type 128 -j DROP</pre>
</description>
<rationale>Responding to broadcast ICMP echo requests facilitates 
network mapping and provides a vector for amplification attacks.</rationale>
<ident stig="GEN007950" />
<oval id="ip6tables_input_icmpv6_broadcast" />
<ref nist="ECSC-1" disa="366" />
</Rule>

<Rule id="system_access_control" severity="medium">
<title>TCP Wrappers Must Be Configured To Grant/Deny Access To Hosts.</title>
<description>To configure the system to grant/deny access to hosts, ensure 
the following file exists:
<tt>/etc/hosts.allow</tt>:
In addition, make sure the following file is present and includes the following line:
<tt>/etc/hosts.deny</tt>:
<pre>ALL: ALL</pre>
</description>
<rationale>If the system's access control program is not configured with appropriate 
rules for allowing and denying access to system network resources, services may be 
accessible to unauthorized hosts.</rationale>
<ident stig="GEN006620" />
<oval id="system_access_control" />
<ref nist="ECCD-1,ECCD-2,ECSC-1" disa="366" />
</Rule>

</Group>
</Group>
