Set Default firewalld Zone for Incoming Packets
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
Description
To set the default zone to drop
for
the built-in default zone which processes incoming IPv4 and IPv6 packets,
modify the following line in
/etc/firewalld/firewalld.conf
to be:
Rationale
In firewalld
the default zone is applied only after all
the applicable rules in the table are examined for a match. Setting the
default zone to drop
implements proper design for a firewall, i.e.
any packets which are not explicitly permitted should not be
accepted.
Warning
To prevent denying any access to the system, automatic remediation
of this control is not available. Remediation must be automated as
a component of machine provisioning, or followed manually as outlined
above.