Ensure IPv6 outbound and established connections are configured

낮음레벨 2수동 검토bottlerocket

설명

Configure the firewall rules for new outbound, and established IPv6 connections. Manual review against site policy.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Run the following command and verify all rules for new outbound, and established connections match site policy: # ip6tables -L -v -n

조치 방법

조치 방식: 가이드 또는 인프라 패치

Configure iptables in accordance with site policy. The following commands will implement a policy to allow all outbound connections and all established connections: # ip6tables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT # ip6tables -A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT # ip6tables -A OUTPUT -p icmp -m state --state NEW,ESTABLISHED -j ACCEPT # ip6tables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT # ip6tables -A INPUT -p udp -m state --state ESTABLISHED -j ACCEPT # ip6tables -A INPUT -p icmp -m state --state ESTABLISHED -j ACCEPT

속성

운영 체제: 모두
태그: bottlerocketnetwork
참고 자료: CIS Bottlerocket Benchmark v1.0.0 - 3.4.2.3 Ensure IPv6 outbound and established connections are configured