<Group id="network-iptables">
<title>iptables and ip6tables</title>
<description>A host-based firewall called <tt>netfilter</tt> is included as
part of the Linux kernel distributed with the system. It is
activated by default. This firewall is controlled by the program
<tt>iptables</tt>, and the entire capability is frequently referred to by
this name. An analogous program called <tt>ip6tables</tt> handles filtering
for IPv6.
<br /><br />
Unlike TCP Wrappers, which depends on the network server
program to support and respect the rules written, <tt>netfilter</tt>
filtering occurs at the kernel level, before a program can even
process the data from the network packet. As such, any program on
the system is affected by the rules written.
<br /><br />
This section provides basic information about strengthening
the <tt>iptables</tt> and <tt>ip6tables</tt> configurations included with the system.
For more complete information that may allow the construction of a
sophisticated ruleset tailored to your environment, please consult
the references at the end of this section.</description>

<Group id="iptables_activation">
<title>Inspect and Activate Default Rules</title>
<description>View the currently-enforced <tt>iptables</tt> rules by running
the command:
<pre>$ sudo iptables -nL --line-numbers</pre>
The command is analogous for <tt>ip6tables</tt>.
<br /><br />
If the firewall does not appear to be active (i.e., no rules
appear), activate it and ensure that it starts at boot by issuing
the following commands (and analogously for <tt>ip6tables</tt>):
<pre>$ sudo service iptables restart</pre>
The default iptables rules are:
<pre>Chain INPUT (policy ACCEPT)
num  target     prot opt source       destination
1    ACCEPT     all  --  0.0.0.0/0    0.0.0.0/0    state RELATED,ESTABLISHED 
2    ACCEPT     icmp --  0.0.0.0/0    0.0.0.0/0
3    ACCEPT     all  --  0.0.0.0/0    0.0.0.0/0
4    ACCEPT     tcp  --  0.0.0.0/0    0.0.0.0/0    state NEW tcp dpt:22 
5    REJECT     all  --  0.0.0.0/0    0.0.0.0/0    reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT)
num  target     prot opt source       destination
1    REJECT     all  --  0.0.0.0/0    0.0.0.0/0    reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source       destination</pre>
The <tt>ip6tables</tt> default rules are essentially the same.</description>


<Rule id="service_ip6tables_enabled" severity="medium">
<title>Verify ip6tables Enabled if Using IPv6</title>
<description>
<service-enable-macro service="ip6tables" />
</description>
<ocil>
If IPv6 is disabled, this is not applicable.
<br /><br />
<service-enable-check-macro service="ip6tables" /></ocil>
<rationale>The <tt>ip6tables</tt> service provides the system's host-based firewalling
capability for IPv6 and ICMPv6.
</rationale>
<ident cce="27006-6"  stig="RHEL-06-000103" />
<oval id="service_ip6tables_enabled" />
<ref nist="AC-4,CA-3(c),CM-7" disa="32,66,1115,1118,1092,1117,1098,1100,1097,1414"/>
<tested by="DS" on="20121024"/>
</Rule>

<Rule id="set_ip6tables_default_rule" severity="medium">
<title>Set Default ip6tables Policy for Incoming Packets</title>
<description>To set the default policy to DROP (instead of ACCEPT) for
the built-in INPUT chain which processes incoming packets,
add or correct the following line in
<tt>/etc/sysconfig/ip6tables</tt>:
<pre>:INPUT DROP [0:0]</pre>
If changes were required, reload the ip6tables rules:
<pre>$ sudo service ip6tables reload</pre>
</description>
<ocil clause="the default policy for the INPUT chain is not set to DROP">
If IPv6 is disabled, this is not applicable.
<br /><br />
Inspect the file <tt>/etc/sysconfig/ip6tables</tt> to determine
the default policy for the INPUT chain. It should be set to DROP:
<pre>$ sudo grep ":INPUT" /etc/sysconfig/ip6tables</pre>
</ocil>
<rationale>In <tt>ip6tables</tt>, the default policy is applied only after all
the applicable rules in the table are examined for a match. Setting the
default policy to <tt>DROP</tt> implements proper design for a firewall, i.e.
any packets which are not explicitly permitted should not be
accepted.</rationale>
<ident cce="27317-7"  stig="RHEL-06-000523" />
<oval id="set_ip6tables_default_rule" />
<ref nist="CM-7" disa="66,1109,1154,1414" />
</Rule>

<Rule id="service_iptables_enabled" severity="medium">
<title>Verify iptables Enabled</title>
<description>
<service-enable-macro service="iptables" />
</description>
<ocil><service-enable-check-macro service="iptables" /></ocil>
<rationale>
The <tt>iptables</tt> service provides the system's host-based firewalling
capability for IPv4 and ICMP.
</rationale>
<ident cce="27018-1"  stig="RHEL-06-000117" />
<oval id="service_iptables_enabled" />
<ref nist="AC-4,CA-3(c),CM-7" disa="32,66,1115,1118,1092,1117,1098,1100,1097,1414" />
<tested by="DS" on="20121024"/>
</Rule>
</Group><!--<Group id="iptables_activation">-->

<Group id="ruleset_modifications">
<title>Strengthen the Default Ruleset</title>
<description>The default rules can be strengthened. The system
scripts that activate the firewall rules expect them to be defined
in the configuration files <tt>iptables</tt> and <tt>ip6tables</tt> in the directory
<tt>/etc/sysconfig</tt>. Many of the lines in these files are similar
to the command line arguments that would be provided to the programs
<tt>/sbin/iptables</tt> or <tt>/sbin/ip6tables</tt> - but some are quite
different.
<br /><br />
The following recommendations describe how to strengthen the
default ruleset configuration file. An alternative to editing this
configuration file is to create a shell script that makes calls to
the iptables program to load in rules, and then invokes service
iptables save to write those loaded rules to
<tt>/etc/sysconfig/iptables.</tt>
<br /><br />
The following alterations can be made directly to
<tt>/etc/sysconfig/iptables</tt> and <tt>/etc/sysconfig/ip6tables</tt>.
Instructions apply to both unless otherwise noted. Language and address
conventions for regular iptables are used throughout this section;
configuration for ip6tables will be either analogous or explicitly
covered.</description>
<warning category="general">The program <tt>system-config-securitylevel</tt>
allows additional services to penetrate the default firewall rules
and automatically adjusts <tt>/etc/sysconfig/iptables</tt>. This program
is only useful if the default ruleset meets your security
requirements. Otherwise, this program should not be used to make
changes to the firewall configuration because it re-writes the
saved configuration file.</warning>

<Rule id="set_iptables_default_rule" severity="medium">
<title>Set Default iptables Policy for Incoming Packets</title>
<description>To set the default policy to DROP (instead of ACCEPT) for
the built-in INPUT chain which processes incoming packets,
add or correct the following line in
<tt>/etc/sysconfig/iptables</tt>:
<pre>:INPUT DROP [0:0]</pre>
</description>
<ocil clause="the default policy for the INPUT chain is not set to DROP">Inspect the file <tt>/etc/sysconfig/iptables</tt> to determine
the default policy for the INPUT chain. It should be set to DROP:
<pre>$ sudo grep ":INPUT" /etc/sysconfig/iptables</pre>
</ocil>
<rationale>In <tt>iptables</tt> the default policy is applied only after all
the applicable rules in the table are examined for a match. Setting the
default policy to <tt>DROP</tt> implements proper design for a firewall, i.e.
any packets which are not explicitly permitted should not be
accepted.</rationale>
<ident cce="26444-0"  stig="RHEL-06-000120" />
<oval id="set_iptables_default_rule" />
<ref nist="CM-7" disa="66,1109,1154,1414" />
</Rule>

<Rule id="set_iptables_default_rule_forward" severity="medium">
<title>Set Default iptables Policy for Forwarded Packets</title>
<description>To set the default policy to DROP (instead of ACCEPT) for
the built-in FORWARD chain which processes packets that will be forwarded from
one interface to another,
add or correct the following line in
<tt>/etc/sysconfig/iptables</tt>:
<pre>:FORWARD DROP [0:0]</pre>
</description>
<rationale>In <tt>iptables</tt>, the default policy is applied only after all
the applicable rules in the table are examined for a match. Setting the
default policy to <tt>DROP</tt> implements proper design for a firewall, i.e.
any packets which are not explicitly permitted should not be
accepted.</rationale>
<ocil clause="the default policy for the FORWARD chain is not set to DROP">
Run the following command to ensure the default <tt>FORWARD</tt> policy is <tt>DROP</tt>:
<pre>grep ":FORWARD" /etc/sysconfig/iptables</pre>
The output should be similar to the following:
<pre>$ sudo grep ":FORWARD" /etc/sysconfig/iptables
:FORWARD DROP [0:0</pre></ocil>
<ident cce="27186-6"  stig="RHEL-06-000320" />
<oval id="set_iptables_default_rule_forward" />
<ref nist="CM-7" disa="1109" />
</Rule>

<Group id="iptables_icmp_disabled">
<title>Restrict ICMP Message Types</title>
<description>In <tt>/etc/sysconfig/iptables</tt>, the accepted ICMP messages
types can be restricted. To accept only ICMP echo reply, destination
unreachable, and time exceeded messages, remove the line:<br />
<pre>-A INPUT -p icmp --icmp-type any -j ACCEPT</pre>
and insert the lines:
<pre>-A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
-A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
-A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT</pre>
To allow the system to respond to pings, also insert the following line:
<pre>-A INPUT -p icmp --icmp-type echo-request -j ACCEPT</pre>
Ping responses can also be limited to certain networks or hosts by using the -s
option in the previous rule.  Because IPv6 depends so heavily on ICMPv6, it is
preferable to deny the ICMPv6 packets you know you don't need (e.g. ping
requests) in <tt>/etc/sysconfig/ip6tables</tt>, while letting everything else
through:
<pre>-A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP</pre>
If you are going to statically configure the machine's address, it should
ignore Router Advertisements which could add another IPv6 address to the
interface or alter important network settings:
<pre>-A INPUT -p icmpv6 --icmpv6-type router-advertisement -j DROP</pre>
Restricting ICMPv6 message types in <tt>/etc/sysconfig/ip6tables</tt> is not
recommended because the operation of IPv6 depends heavily on ICMPv6. Thus, great
care must be taken if any other ICMPv6 types are blocked.
</description>
<rationale>Restricting ICMP messages may make a system slightly less
discoverable to an unsophisticated attacker but is not appropriate for many
general-purpose use cases and can also make troubleshooting more difficult.
</rationale> 
</Group>

<Group id="iptables_log_and_drop_suspicious">
<title>Log and Drop Packets with Suspicious Source Addresses</title>
<description>Packets with non-routable source addresses should be rejected, as they may indicate spoofing. Because the
modified policy will reject non-matching packets, you only need to add these rules if you are interested in also
logging these spoofing or suspicious attempts before they are dropped. If you do choose to log various suspicious
traffic, add identical rules with a target of <tt>DROP</tt> after each <i>LOG</i>.
To log and then drop these IPv4 packets, insert the following rules in <tt>/etc/sysconfig/iptables</tt> (excepting
any that are intentionally used):
<pre>-A INPUT -s 10.0.0.0/8 -j LOG --log-prefix "IP DROP SPOOF A: "
-A INPUT -s 172.16.0.0/12 -j LOG --log-prefix "IP DROP SPOOF B: "
-A INPUT -s 192.168.0.0/16 -j LOG --log-prefix "IP DROP SPOOF C: "
-A INPUT -s 224.0.0.0/4 -j LOG --log-prefix "IP DROP MULTICAST D: "
-A INPUT -s 240.0.0.0/5 -j LOG --log-prefix "IP DROP SPOOF E: "
-A INPUT -d 127.0.0.0/8 -j LOG --log-prefix "IP DROP LOOPBACK: "</pre>
Similarly, you might wish to log packets containing some IPv6 reserved addresses if they are not expected
on your network:
<pre>-A INPUT -i eth0 -s ::1 -j LOG --log-prefix "IPv6 DROP LOOPBACK: "
-A INPUT -s 2002:E000::/20 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: "
-A INPUT -s 2002:7F00::/24 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: "
-A INPUT -s 2002:0000::/24 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: "
-A INPUT -s 2002:FF00::/24 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: "
-A INPUT -s 2002:0A00::/24 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: "
-A INPUT -s 2002:AC10::/28 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: "
-A INPUT -s 2002:C0A8::/32 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: "</pre>
If you are not expecting to see site-local multicast or auto-tunneled traffic, you can log those:
<pre>-A INPUT -s FF05::/16 -j LOG --log-prefix "IPv6 SITE-LOCAL MULTICAST: "
-A INPUT -s ::0.0.0.0/96 -j LOG --log-prefix "IPv4 COMPATIBLE IPv6 ADDR: "</pre>
If you wish to block multicasts to all link-local nodes (e.g. if you are not using router auto-configuration and
do not plan to have any services that multicast to the entire local network), you can block the link-local
all-nodes multicast address (before accepting incoming ICMPv6):
<pre>-A INPUT -d FF02::1 -j LOG --log-prefix "Link-local All-Nodes Multicast: "</pre>
However, if you're going to allow IPv4 compatible IPv6 addresses (of the form ::0.0.0.0/96), you should
then consider logging the non-routable IPv4-compatible addresses:
<pre>-A INPUT -s ::0.0.0.0/104 -j LOG --log-prefix "IP NON-ROUTABLE ADDR: "
-A INPUT -s ::127.0.0.0/104 -j LOG --log-prefix "IP DROP LOOPBACK: "
-A INPUT -s ::224.0.0.0.0/100 -j LOG --log-prefix "IP DROP MULTICAST D: "
-A INPUT -s ::255.0.0.0/104 -j LOG --log-prefix "IP BROADCAST: "</pre>
If you are not expecting to see any IPv4 (or IPv4-compatible) traffic on your network, consider logging it before it gets dropped:
<pre>-A INPUT -s ::FFFF:0.0.0.0/96 -j LOG --log-prefix "IPv4 MAPPED IPv6 ADDR: "
-A INPUT -s 2002::/16 -j LOG --log-prefix "IPv6 6to4 ADDR: "</pre>
The following rule will log all traffic originating from a site-local address, which is deprecated address space:
<pre>-A INPUT -s FEC0::/10 -j LOG --log-prefix "SITE-LOCAL ADDRESS TRAFFIC: "</pre>
</description>
</Group>

</Group>
</Group>
