Check Details

• Resource: Server
• Check: Ensure IPv6 firewall rules exist for all open ports
• Risk: Open ports without firewall rules can allow unauthorized access or expose services to attacks.

Remediation Steps

1. Open a terminal session with root or sudo privileges.

2. Identify all open IPv6 ports:

   

   ss -6tuln
   

3. Check existing IPv6 firewall rules:

   

   ip6tables -L INPUT -v -n
   

4. Verify that each open port has a corresponding firewall rule allowing inbound traffic.

5. Add firewall rules for missing ports using the following syntax:

   

   ip6tables -A INPUT -p <protocol> --dport <port> -m state --state NEW -j ACCEPT
   

6. Examples for commonly used ports:

   SSH (port 22):

   

   ip6tables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT
   

   HTTP (port 80):

   

   ip6tables -A INPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT
   

   HTTPS (port 443):

   

   ip6tables -A INPUT -p tcp --dport 443 -m state --state NEW -j ACCEPT
   

   DNS (port 53 - TCP & UDP):

   

   ip6tables -A INPUT -p tcp --dport 53 -m state --state NEW -j ACCEPT
   ip6tables -A INPUT -p udp --dport 53 -m state --state NEW -j ACCEPT
   

7. Save the firewall rules to persist after reboot (distribution-specific).
8. Re-run audit commands to confirm rules are correctly applied.
9. Perform periodic audits to ensure ongoing compliance.