CME-202

Host-Based Firewall (firewalld/nftables)

Isolate Network Unquantified evidence Preventive

Description

Per-host network access control using firewalld zones or nftables rules. Restricts which network sources can reach specific services, reducing attack surface.

CVSS Vector Impacts

Metric	Transition	Rationale
Attack Vector (AV)	N → A	Service only reachable from adjacent/authorized networks
Scope (S)	C → U	Firewall prevents lateral movement to other services

CWE Relationships

CWE-284

ATT&CK Technique Crosswalks

Verification

Verify firewalld is running with restrictive zone

$ firewall-cmd --state
# Expected: running

Platform: rhel

$ firewall-cmd --get-active-zones
# Expected: public

Platform: rhel

$ nft list ruleset | head -20
# Expected: table

Platform: linux

Remediation

rhel firewalld zone-based service restriction


systemctl enable --now firewalld
firewall-cmd --set-default-zone=drop
firewall-cmd --permanent --zone=drop --add-rich-rule='rule family=ipv4 source address=<mgmt_cidr> service name=ssh accept'
firewall-cmd --permanent --zone=drop --add-rich-rule='rule family=ipv4 source address=<client_cidr> port port=<service_port> protocol=tcp accept'
firewall-cmd --reload

linux nftables default-deny ruleset with per-service allowlisting


printf '#!/usr/sbin/nft -f\nflush ruleset\ntable inet filter {\n  chain input {\n    type filter hook input priority 0; policy drop;\n    ct state established,related accept\n    ct state invalid drop\n    iif lo accept\n    ip protocol icmp accept\n    ip6 nexthdr icmpv6 accept\n    ip saddr <mgmt_cidr> tcp dport 22 accept\n    ip saddr <client_cidr> tcp dport <service_port> accept\n  }\n  chain forward {\n    type filter hook forward priority 0; policy drop;\n  }\n  chain output {\n    type filter hook output priority 0; policy accept;\n  }\n}\n' > /etc/nftables/cme-202.nft
grep -q 'cme-202.nft' /etc/sysconfig/nftables.conf 2>/dev/null || echo 'include "/etc/nftables/cme-202.nft"' >> /etc/sysconfig/nftables.conf
nft -f /etc/nftables/cme-202.nft
systemctl enable nftables