Ensure IPv6 outbound and established connections are configured

BajaNivel 2Revisión manualbottlerocket

Descripción

Configure the firewall rules for new outbound, and established IPv6 connections. Manual review against site policy.

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

Run the following command and verify all rules for new outbound, and established connections match site policy: # ip6tables -L -v -n

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Configure iptables in accordance with site policy. The following commands will implement a policy to allow all outbound connections and all established connections: # ip6tables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT # ip6tables -A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT # ip6tables -A OUTPUT -p icmp -m state --state NEW,ESTABLISHED -j ACCEPT # ip6tables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT # ip6tables -A INPUT -p udp -m state --state ESTABLISHED -j ACCEPT # ip6tables -A INPUT -p icmp -m state --state ESTABLISHED -j ACCEPT

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: bottlerocketnetwork
Referencia: CIS Bottlerocket Benchmark v1.0.0 - 3.4.2.3 Ensure IPv6 outbound and established connections are configured