STIGQter: STIG Summary: Red Hat Enterprise Linux 8 Security Technical Implementation Guide Version: 2 Release: 8 Benchmark Date: 01 Jul 2026:

A RHEL 8 firewall must employ a deny-all, allow-by-exception policy for allowing connections to other systems.

DISA Rule

SV-230504r958672_rule

Vulnerability Number

V-230504

Group Title

SRG-OS-000297-GPOS-00115

Rule Version

RHEL-08-040090

Severity

CAT II

CCI(s)

• CCI-002314 - Employ automated mechanisms to control remote access methods.

Weight

10

Fix Recommendation

Configure the "firewalld" daemon to employ a deny-all, allow-by-exception with the following commands:

$ sudo firewall-cmd --permanent --new-zone=[custom]

$ sudo cp /usr/lib/firewalld/zones/drop.xml /etc/firewalld/zones/[custom].xml

This will provide a clean configuration file to work with that employs a deny-all approach.

Note: Add the exceptions that are required for mission functionality and update the short title in the xml file to match the [custom] zone name.

Reload the firewall rules to make the new [custom] zone available to load:
$ sudo firewall-cmd --reload

Set the default zone to the new [custom] zone:
$ sudo firewall-cmd --set-default-zone=[custom]

Note: This is a runtime and permanent change.
Add any interfaces to the new [custom] zone:
$ sudo firewall-cmd --permanent --zone=[custom] --change-interface=ens33

Reload the firewall rules for changes to take effect:
$ sudo firewall-cmd --reload

Check Contents

Verify "firewalld" is configured to employ a deny-all, allow-by-exception policy for allowing connections to other systems with the following commands:

$ sudo firewall-cmd --state
running

$ sudo firewall-cmd --get-active-zones
[custom]
interfaces: ens33

$ sudo firewall-cmd --info-zone=[custom] | grep target
target: DROP

If no zones are active on the RHEL 8 interfaces or if the target is set to a different option other than "DROP", this is a finding.

If the "firewalld" package is not installed, ask the System Administrator if an alternate firewall (such as iptables) is installed and in use, and how is it configured to employ a deny-all, allow-by-exception policy.

If the alternate firewall is not configured to employ a deny-all, allow-by-exception policy, this is a finding.

If no firewall is installed, this is a finding.

Vulnerability Number

V-230504

Documentable

False

Rule Version

RHEL-08-040090

Severity Override Guidance

Verify "firewalld" is configured to employ a deny-all, allow-by-exception policy for allowing connections to other systems with the following commands:

$ sudo firewall-cmd --state
running

$ sudo firewall-cmd --get-active-zones
[custom]
interfaces: ens33

$ sudo firewall-cmd --info-zone=[custom] | grep target
target: DROP

If no zones are active on the RHEL 8 interfaces or if the target is set to a different option other than "DROP", this is a finding.

If the "firewalld" package is not installed, ask the System Administrator if an alternate firewall (such as iptables) is installed and in use, and how is it configured to employ a deny-all, allow-by-exception policy.

If the alternate firewall is not configured to employ a deny-all, allow-by-exception policy, this is a finding.

If no firewall is installed, this is a finding.

Check Content Reference

M

Target Key

2921