Set Default ip6tables Policy for Incoming Packets
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
Description
To set the default policy to DROP (instead of ACCEPT) for
the built-in INPUT chain which processes incoming packets,
add or correct the following line in
/etc/iptables/rules.v6:
If changes were required, reload the ip6tables rules:
$ sudo service ip6tables reload
Rationale
In ip6tables, the default policy is applied only after all
the applicable rules in the table are examined for a match. Setting the
default policy to DROP implements proper design for a firewall, i.e.
any packets which are not explicitly permitted should not be
accepted.
Warning
Automated remediation for this rule is disabled.
Changing firewall settings while connected over network can
result in being locked out of the system.
