mediumnetworkverified ✓
Ensure nftables loopback traffic is configured
nftables-loopback · RHEL ≥ 8 · 2 impls
Description
When using nftables directly, loopback traffic should be configured to allow localhost communication while blocking spoofed loopback traffic.
Rationale
Loopback traffic is essential for local services. However, spoofed loopback traffic from external sources should be blocked.
Check → Remediate
Checkcommand
systemctl is-active firewalld >/dev/null 2>&1 && echo 'OK: using firewalld' || { echo 'FAIL: no firewall active'; exit 1; }- expected_exit:
- 0
Remediatemanual
- note:
- Enable either firewalld or nftables to enforce firewall policies.
Framework references
CIS
rhel9 4.3.4
NIST 800-53
SC-7
Live verification
rhel9:check
#firewall#nftables#loopback#security