Servers – Ensure Default Deny Firewall Policy is Configured

Support > Fixing Checks > Server

06 March, 2026

This check ensures that a default deny firewall policy is enforced on the server.

A default deny policy ensures that all incoming, outgoing, and forwarded traffic is blocked unless explicitly allowed, reducing the risk of unauthorized access.

Check Details

Resource: Server
Check: Ensure default deny firewall policy is configured
Risk: Without a default deny policy, unintended or malicious network traffic may be allowed.

Remediation Steps

Open a terminal session with root or sudo privileges.
Verify the current firewall policy:
```
sudo iptables -L
```
Ensure that the default policies for INPUT, OUTPUT, and FORWARD chains are set to DROP or REJECT.

Apply default deny policy using the following commands:

sudo iptables -P INPUT DROP
sudo iptables -P OUTPUT DROP
sudo iptables -P FORWARD DROP

Before applying the above rules, ensure that necessary ALLOW rules (e.g., SSH) are configured to prevent losing remote access.
Be cautious when modifying firewall rules over a remote connection, as incorrect configuration may result in being locked out of the system.
To make firewall rules persistent across reboots, configure them using your system’s firewall management tools (such as iptables-save or firewall configuration files).
Re-run the audit command to confirm the configuration.
Perform regular audits to ensure continued compliance.

Other Articles

Servers – Ensure Default Deny Firewall Policy is Configured

Check Details

Remediation Steps