STIGQter: STIG Summary: Anduril NixOS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Oct 2025:

NixOS must enable the built-in firewall.

DISA Rule

SV-268078r1130947_rule

Vulnerability Number

V-268078

Group Title

SRG-OS-000298-GPOS-00116

Rule Version

ANIX-00-000010

Severity

CAT II

CCI(s)

CCI-002322 - Provide the capability to disconnect or disable remote access to the system within the organization-defined time period.
CCI-000382 - Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.
CCI-002314 - Employ automated mechanisms to control remote access methods.
CCI-000366 - Implement the security configuration settings.

Weight

Fix Recommendation

Update the NixOS config, typically stored either in /etc/nixos/configuration.nix or /etc/nixos/flake.nix, to enforce firewall rules by adding the following configuration settings:

networking.firewall.enable = true;

Rebuild and switch to the new NixOS configuration:
$ sudo nixos-rebuild switch

Check Contents

Verify NixOS has the network firewall enabled with the following command:

$ sudo iptables -L | grep nixos-fw-log-refuse

nixos-fw-log-refuse all -- anywhere anywhere

Verify the firewall panic tools are present:
$ which firewall-panic
/run/current-system/sw/bin/firewall-panic

$ which firewall-panic-off
/run/current-system/sw/bin/firewall-panic-off

If the "nixos-fw-log-refuse all -- anywhere anywhere" firewall rule is not present and the firewall panic commands are not found, this is a finding.

Vulnerability Number

V-268078

Documentable

False

Rule Version

ANIX-00-000010

Severity Override Guidance

Check Content Reference

Target Key

5658