Firewalld way how to change default policy type from ACCEPT to something else for a particular chain

Jan Lieskovsky jlieskov at redhat.com
Tue Oct 7 14:35:20 UTC 2014


Hello folks,

  we develop security guidance / compliance related tools and content
for Red Hat Enterprise Linux. Recently within the effort to port old(er)
iptables sections from Red Hat Enterprise Linux 6 to Red Hat Enterprise
Linux 7 we encountered the following firewalld related question.

Please have a look at sample guidance document at:
  [1] https://jlieskov.fedorapeople.org/rhel6-guide.html

In the section "2.5.7. iptables and ip6tables", under rule:
"2.5.7.2.a. Set Default iptables Policy for Incoming Packets" there's
the following requirement:

<quote>
To set the default policy to DROP (instead of ACCEPT) for the
built-in INPUT chain which processes incoming packets, add or
correct the following line in /etc/sysconfig/iptables:

:INPUT DROP [0:0]
</quote>

The question is how to ensure the iptables rule of the exact meaning
is applied on the system by using firewalld related tools? In other
words is there a way via firewalld tools how to change default policy
type from "ACCEPT" to e.g. "DROP" for some particular filter chain
(e.g. "INPUT")? [*]

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team

[*] We are aware that firewalld uses different configuration file
    than /etc/sysconfig/iptables & can handle that. But the question
    is how to change the default policy type from 'ACCEPT' to something
    else.


More information about the firewalld-users mailing list