Ensure IPv6 outbound and established connections are configured

FaibleNiveau 2Revue manuellebottlerocket

Description

Configure the firewall rules for new outbound, and established IPv6 connections. Manual review against site policy.

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

Run the following command and verify all rules for new outbound, and established connections match site policy: # ip6tables -L -v -n

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Configure iptables in accordance with site policy. The following commands will implement a policy to allow all outbound connections and all established connections: # ip6tables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT # ip6tables -A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT # ip6tables -A OUTPUT -p icmp -m state --state NEW,ESTABLISHED -j ACCEPT # ip6tables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT # ip6tables -A INPUT -p udp -m state --state ESTABLISHED -j ACCEPT # ip6tables -A INPUT -p icmp -m state --state ESTABLISHED -j ACCEPT

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: bottlerocketnetwork
Référence: CIS Bottlerocket Benchmark v1.0.0 - 3.4.2.3 Ensure IPv6 outbound and established connections are configured