documentation_complete: true


title: 'Configure Firewalld to Use the Nftables Backend'

description: |-
    Firewalld can be configured with many backends, such as nftables.

rationale: |-
    Nftables is modern kernel module for controlling network connections coming into a system.
    Utilizing the limit statement in "nftables" can help to mitigate DoS attacks.

severity: medium

platform: package[firewalld]

identifiers:
    cce@rhel8: CCE-86506-3
    cce@rhel9: CCE-86507-1
    cce@rhel10: CCE-87099-8
    cce@sle15: CCE-92470-4
    cce@slmicro5: CCE-94012-2

references:
    cis@sle15: 3.5.2.1
    nist: SC-5
    srg: SRG-OS-000420-GPOS-00186
    stigid@ol8: OL08-00-040150

ocil_clause: 'the "nftables" is not set as the "firewallbackend"'

ocil: |-
    Verify "nftables" is configured to allow rate limits on any connection to the system with the following command:

    Verify "firewalld" has "nftables" set as the default backend:

    $ sudo grep -i firewallbackend /etc/firewalld/firewalld.conf

    # FirewallBackend
    FirewallBackend=nftables

fixtext: |-
    Configure "nftables" to be the default "firewallbackend" for "firewalld" by adding or editing the following line in "/etc/firewalld/firewalld.conf":

    FirewallBackend=nftables

    Establish rate-limiting rules based on organization-defined types of DoS attacks on impacted network interfaces.

srg_requirement: 'A firewall must be able to protect against or limit the effects of Denial of Service (DoS) attacks by ensuring {{{ full_name }}} can implement rate-limiting measures on impacted network interfaces.'

template:
    name: shell_lineinfile
    vars:
        path: /etc/firewalld/firewalld.conf
        parameter: FirewallBackend
        value: nftables
        no_quotes: 'true'
