Page Comparison

Problem

Solution

Most operating systems have or will be deprecating iptables. In alignment with this, CIS Benchmarks have been updated to provide secure configuration guidance for the use of nftables in place of iptables.

If this transition in a new CIS Hardened Image is resulting in integration issues, temporary solutions are below. For security best practice, migration to nftables should be completed.

1. Opt instead to use iptables-nft. This is a bridge between iptables-legacy and nftables. It will allow you to use your legacy firewall rules. Please note that while iptables-nft can supplant iptables-legacy, ideally you would not want to use them simultaneously. Please consider this option while using the existing legacy rules you provided. iptables:

   • iptables: The two variants and their relationship with nftables

   • https://www.redhat.com/en/blog/using-iptables-nft-hybrid-linux-firewall

2. Migrate/downgrade from nftables to iptables-legacy for this Benchmark. There are a few guides out there on how to accomplish this downgrade. From there you should be able to implement your existing firewall rules without having to make additional changes.

Additional Insights:

The default ruleset can be viewed by running:

$ nft list ruleset

and this will show the set defaults that only open ICMP, IGMP, and port 22(ssh) from anywhere. To open an ECS agent port to all traffic for ECS testing you could craft a rule that would something to the effect of:

$ nft add rule inet filter input tcp dport 51678 accept
$ nft add rule inet filter input iifname "ecs-bridge" ip daddr 127.0.0.0/8 tcp dport 51679 counter accept
$ nft add rule inet filter input iifname "docker0" ip daddr 127.0.0.0/8 tcp dport 51679 counter accept

Alternative you could remove every rule for testing to confirm cause with:

$ nft flush ruleset

from there you would have to restart the nft service or system.

Keywords; Hardened Images nftables iptables linux

Content by Label