documentation_complete: true

title: 'Strengthen the Default Ruleset'

platform: package[iptables]

description: |-
    The default rules can be strengthened. The system
    scripts that activate the firewall rules expect them to be defined
    in the configuration files <tt>iptables</tt> and <tt>ip6tables</tt> in the directory
    <tt>/etc/sysconfig</tt>. Many of the lines in these files are similar
    to the command line arguments that would be provided to the programs
    <tt>/sbin/iptables</tt> or <tt>/sbin/ip6tables</tt> - but some are quite
    different.
    <br /><br />
    The following recommendations describe how to strengthen the
    default ruleset configuration file. An alternative to editing this
    configuration file is to create a shell script that makes calls to
    the iptables program to load in rules, and then invokes service
    iptables save to write those loaded rules to
    <tt>/etc/sysconfig/iptables.</tt>
    <br /><br />
    The following alterations can be made directly to
    <tt>/etc/sysconfig/iptables</tt> and <tt>/etc/sysconfig/ip6tables</tt>.
    Instructions apply to both unless otherwise noted. Language and address
    conventions for regular iptables are used throughout this section;
    configuration for ip6tables will be either analogous or explicitly
    covered.

warnings:
    - general: |-
        The program <tt>system-config-securitylevel</tt>
        allows additional services to penetrate the default firewall rules
        and automatically adjusts <tt>/etc/sysconfig/iptables</tt>. This program
        is only useful if the default ruleset meets your security
        requirements. Otherwise, this program should not be used to make
        changes to the firewall configuration because it re-writes the
        saved configuration file.
