Firewalld way how to change default policy type from ACCEPT to something else for a particular chain
Jan Lieskovsky
jlieskov at redhat.com
Tue Oct 7 14:35:20 UTC 2014
Hello folks,
we develop security guidance / compliance related tools and content
for Red Hat Enterprise Linux. Recently within the effort to port old(er)
iptables sections from Red Hat Enterprise Linux 6 to Red Hat Enterprise
Linux 7 we encountered the following firewalld related question.
Please have a look at sample guidance document at:
[1] https://jlieskov.fedorapeople.org/rhel6-guide.html
In the section "2.5.7. iptables and ip6tables", under rule:
"2.5.7.2.a. Set Default iptables Policy for Incoming Packets" there's
the following requirement:
<quote>
To set the default policy to DROP (instead of ACCEPT) for the
built-in INPUT chain which processes incoming packets, add or
correct the following line in /etc/sysconfig/iptables:
:INPUT DROP [0:0]
</quote>
The question is how to ensure the iptables rule of the exact meaning
is applied on the system by using firewalld related tools? In other
words is there a way via firewalld tools how to change default policy
type from "ACCEPT" to e.g. "DROP" for some particular filter chain
(e.g. "INPUT")? [*]
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
[*] We are aware that firewalld uses different configuration file
than /etc/sysconfig/iptables & can handle that. But the question
is how to change the default policy type from 'ACCEPT' to something
else.
More information about the firewalld-users
mailing list