documentation_complete: true

title: 'Strengthen the Default Ruleset'

description: |-
    The default rules can be strengthened. The system
    scripts that activate the firewall rules expect them to be defined
    in the configuration files <tt>iptables</tt> and <tt>ip6tables</tt> in the directory
    <tt>/etc/sysconfig</tt>. Many of the lines in these files are similar
    to the command line arguments that would be provided to the programs
    <tt>/sbin/iptables</tt> or <tt>/sbin/ip6tables</tt> - but some are quite
    different.
    <br /><br />
    The following recommendations describe how to strengthen the
    default ruleset configuration file. An alternative to editing this
    configuration file is to create a shell script that makes calls to
    the iptables program to load in rules, and then invokes service
    iptables save to write those loaded rules to
    <tt>/etc/sysconfig/iptables.</tt>
    <br /><br />
    The following alterations can be made directly to
    <tt>/etc/sysconfig/iptables</tt> and <tt>/etc/sysconfig/ip6tables</tt>.
    Instructions apply to both unless otherwise noted. Language and address
    conventions for regular iptables are used throughout this section;
    configuration for ip6tables will be either analogous or explicitly
    covered.
