mediumnetworkunverifiedrollback-safe
Ensure firewalld uses the nftables backend
firewalld-nftables-backend · RHEL ≥ 8 · 1 impl
Description
The firewalld FirewallBackend must be set to nftables so the firewall can apply connection rate-limiting and other protections against denial-of-service floods.
Rationale
The nftables backend supports the rate-limiting primitives firewalld relies on to limit the effects of a denial-of-service attack. The legacy iptables backend does not provide equivalent protection.
Check → Remediate
Checkcommand
grep -qiE '^\s*FirewallBackend\s*=\s*nftables' /etc/firewalld/firewalld.conf
- expected_exit:
- 0
Remediateconfig_set
- path:
- /etc/firewalld/firewalld.conf
- key:
- FirewallBackend
- value:
- nftables
- separator:
- =
- restart:
- firewalld
Framework references
CIS
rhel8 4.1.2rhel10 4.1.2
STIG
V-281361 / RHEL-10-800290V-257939 / RHEL-09-251030V-230525 / RHEL-08-040150
NIST 800-53
SC-5
#firewalld#nftables#dos#hardening#stig