Ensure IPv6 outbound and established connections are configured

LowLevel 2Manual reviewbottlerocket

Description

Configure the firewall rules for new outbound, and established IPv6 connections. Manual review against site policy.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Run the following command and verify all rules for new outbound, and established connections match site policy: # ip6tables -L -v -n

How it is fixed

Fix method: Guidance or infrastructure patch

Configure iptables in accordance with site policy. The following commands will implement a policy to allow all outbound connections and all established connections: # ip6tables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT # ip6tables -A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT # ip6tables -A OUTPUT -p icmp -m state --state NEW,ESTABLISHED -j ACCEPT # ip6tables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT # ip6tables -A INPUT -p udp -m state --state ESTABLISHED -j ACCEPT # ip6tables -A INPUT -p icmp -m state --state ESTABLISHED -j ACCEPT

Properties

Operating systems: Any
Tags: bottlerocketnetwork
Reference: CIS Bottlerocket Benchmark v1.0.0 - 3.4.2.3 Ensure IPv6 outbound and established connections are configured