mediumnetworkverified ✓
Ensure nftables base chains exist
nftables-base-chains · RHEL ≥ 8 · 2 impls
Description
When using nftables directly, base chains for input, forward, and output traffic must be configured.
Rationale
Base chains are required to process network traffic. Without them, nftables rules cannot be applied to filter network traffic.
Check → Remediate
Checkcommand
systemctl is-active firewalld >/dev/null 2>&1 && echo 'OK: using firewalld' || { echo 'FAIL: no firewall active'; exit 1; }- expected_exit:
- 0
Remediatemanual
- note:
- Enable either firewalld or nftables to enforce firewall policies.
Framework references
CIS
rhel9 4.3.1
NIST 800-53
SC-7
Live verification
rhel9:check
#firewall#nftables#security