Other Articles

Servers – Ensure IPv6 Default Deny Firewall Policy

Support > Fixing Checks > Server

06 March, 2026

This check ensures that the default IPv6 firewall policy is set to deny all traffic unless explicitly allowed.

A default deny policy improves security by blocking all unconfigured network traffic, reducing the risk of unauthorized access and attacks.

Check Details

  • Resource: Server
  • Check: Ensure IPv6 default firewall policy is set to DROP or REJECT
  • Risk: Default allow policies can expose the system to unauthorized network access and increase attack surface.

Remediation Steps

  1. Open a terminal session with root or sudo privileges.

  2. Verify current IPv6 firewall policy:

    ip6tables -L
  3. Ensure that the default policy for INPUT, OUTPUT, and FORWARD chains is set to DROP or REJECT.

  4. If not configured correctly, apply a default deny policy:

    ip6tables -P INPUT DROP
ip6tables -P OUTPUT DROP
ip6tables -P FORWARD DROP

  5. Save the firewall rules to ensure persistence after reboot (depending on your system):

    sudo ip6tables-save > /etc/ip6tables/rules.v6

  6. Verify the updated configuration:

    ip6tables -L
  7. Perform regular audits to ensure compliance and proper firewall configuration.