mediumnetworkverified ✓

Ensure nftables established connections are configured

nftables-established-connections · RHEL ≥ 8 · 1 impl

Description

The nftables ruleset must accept packets belonging to established and related connections so that return traffic for permitted outbound connections is allowed.

Rationale

Without an established/related accept rule, stateful return traffic is dropped, breaking legitimate connections or driving operators to overly permissive rules. The stateful accept is the basis of a correct deny-by-default firewall.

Check → Remediate

Checkcommand

if ! command -v nft >/dev/null 2>&1; then echo "FAIL: nft not available"; exit 1; fi
if nft list ruleset 2>/dev/null | grep -qiE 'ct state.*(established|related)'; then
  echo "OK: nftables accepts established/related connections"; exit 0
fi
echo "FAIL: no established/related accept rule in nftables ruleset"; exit 1

expected_exit:: 0

Remediatemanual

note:: Add a stateful accept to the nftables input chain, e.g. `nft add rule inet filter input ct state established,related accept`, and persist it in the nftables configuration.

Framework references

CIS

rhel9 4.3.2

NIST 800-53

SC-7AC-4

Live verification

rhel9:check

#firewall#nftables#stateful