OpenVAPTMediumNET-FW-001Network ExposureNetwork
No Active Host Firewall
Checks whether a host firewall (nftables, iptables, ufw or firewalld) is filtering incoming traffic.
- Why It Matters
- A default-deny host firewall is a safety net: a service that is installed or misconfigured by mistake is still not reachable from the internet.
- How It Detects
- Runs read-only status commands in order: ufw status, firewall-cmd --state, nft list ruleset, iptables -S. Passes if ufw/firewalld report active, or if nftables/iptables contain a drop/reject rule or a DROP input policy.
- How to Fix
- Ubuntu: ufw default deny incoming && ufw allow OpenSSH && ufw allow 80,443/tcp && ufw enable . RHEL family: systemctl enable --now firewalld . Always allow SSH before enabling, or you will lock yourself out.
- How to Verify
ufw status verbose or firewall-cmd --list-all or nft list ruleset- CVSS v3.1 Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L- Control Category
- Network Exposure: CIS Controls v8 4, 12, 13; NIST CSF 2.0 PR.IR, PR.PS
- Fix Effort
- Medium
- CIS Controls v8 Safeguard
- 4.4
- NIST CSF 2.0 Subcategory
- PR.IR-01
- CWE
- CWE-923
- NIST SP 800-53 Rev. 5
- SC-7
- Benchmark Topic
- Host-based firewall configured (topic only, no benchmark text)
- References
- NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy
nftables wiki
Learn the theory behind this check: F1 Security Basics, P3 Network Exposure and Firewalls.
Source Code
The complete file that defines this check. Run it with openvapt scan --only NET-FW-001, or read it offline with openvapt explain NET-FW-001.
internal/checks/network/firewall.go · Lines 1-61View on GitHub at This Commit
| 1 | package network |
| 2 | |
| 3 | import ( |
| 4 | "context" |
| 5 | "strings" |
| 6 | |
| 7 | "github.com/openvapt/openvapt/internal/check" |
| 8 | "github.com/openvapt/openvapt/internal/sys" |
| 9 | ) |
| 10 | |
| 11 | func init() { |
| 12 | check.Register(&check.Check{ |
| 13 | ID: "NET-FW-001", |
| 14 | Title: "No Active Host Firewall", |
| 15 | Domain: check.DomainNetwork, |
| 16 | Severity: check.Medium, |
| 17 | CVSS: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", |
| 18 | Summary: "Checks whether a host firewall (nftables, iptables, ufw or firewalld) is filtering incoming traffic.", |
| 19 | Rationale: "A default-deny host firewall is a safety net: a service that is installed or misconfigured by mistake is still not reachable from the internet.", |
| 20 | Detection: "Runs read-only status commands in order: ufw status, firewall-cmd --state, nft list ruleset, iptables -S. Passes if ufw/firewalld report active, or if nftables/iptables contain a drop/reject rule or a DROP input policy.", |
| 21 | Fix: "Ubuntu: ufw default deny incoming && ufw allow OpenSSH && ufw allow 80,443/tcp && ufw enable . RHEL family: systemctl enable --now firewalld . Always allow SSH before enabling, or you will lock yourself out.", |
| 22 | Verify: "ufw status verbose or firewall-cmd --list-all or nft list ruleset", |
| 23 | Refs: []check.Ref{{Title: "NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy", URL: "https://csrc.nist.gov/pubs/sp/800/41/r1/final"}, |
| 24 | {Title: "nftables wiki", URL: "https://wiki.nftables.org/wiki-nftables/index.php/Main_Page"}}, |
| 25 | Standards: check.Standards{CWE: []string{"CWE-923"}, NIST: []string{"SC-7"}, CISTopic: "Host-based firewall configured"}, |
| 26 | Run: func(ctx context.Context, s sys.System) []check.Result { |
| 27 | if out, err := s.Run(ctx, "ufw", "status", "verbose"); err == nil && strings.Contains(strings.ToLower(out), "status: active") { |
| 28 | l := strings.ToLower(out) |
| 29 | if strings.Contains(l, "default: deny (incoming)") || strings.Contains(l, "default: reject (incoming)") { |
| 30 | return []check.Result{check.PassR("firewall", "ufw has a default-deny incoming policy")} |
| 31 | } |
| 32 | return []check.Result{check.FailR("firewall", "ufw is active but its incoming default policy is not deny or reject")} |
| 33 | } |
| 34 | if out, err := s.Run(ctx, "firewall-cmd", "--state"); err == nil && strings.TrimSpace(out) == "running" { |
| 35 | return []check.Result{check.IncompleteR("firewall", "firewalld is running, but its effective active-zone policy could not be determined")} |
| 36 | } |
| 37 | if out, err := s.Run(ctx, "nft", "list", "ruleset"); err == nil { |
| 38 | l := strings.ToLower(out) |
| 39 | if nftInputDefaultDeny(l) { |
| 40 | return []check.Result{check.PassR("firewall", "nftables filters input traffic")} |
| 41 | } |
| 42 | } |
| 43 | if out, err := s.Run(ctx, "iptables", "-S"); err == nil { |
| 44 | if strings.Contains(out, "-P INPUT DROP") || strings.Contains(out, "-P INPUT REJECT") { |
| 45 | return []check.Result{check.PassR("firewall", "iptables filters input traffic")} |
| 46 | } |
| 47 | return []check.Result{check.FailR("firewall", "iptables has no drop or reject rules (input policy ACCEPT)")} |
| 48 | } |
| 49 | return []check.Result{check.FailR("firewall", "No active host firewall detected (ufw, firewalld, nftables, iptables)")} |
| 50 | }, |
| 51 | }) |
| 52 | } |
| 53 | |
| 54 | func nftInputDefaultDeny(rules string) bool { |
| 55 | for _, block := range strings.Split(rules, "}") { |
| 56 | if strings.Contains(block, "hook input") && (strings.Contains(block, "policy drop") || strings.Contains(block, "policy reject")) { |
| 57 | return true |
| 58 | } |
| 59 | } |
| 60 | return false |
| 61 | } |
Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.
Cite This Page
If this page helped your work, please cite it. The version and web address are filled in; the access date is today's date in your browser. Every other style, and when credit is required, is on How to Cite OpenVAPT.
APA 7
OpenVAPT. (2026). NET-FW-001 No Active Host Firewall (Version 0.1.0-alpha.6). OpenVAPT Check Catalogue. Retrieved October 16, 2026, from https://openvapt.com/checks/NET-FW-001.html
In text: (OpenVAPT, 2026). Accessed: the date shown is today's date from your own browser (the site's build date without JavaScript); change it to the day you read the page.
BibTeX
@misc{openvapt_net_fw_001,
author = {{OpenVAPT}},
title = {{NET-FW-001 No Active Host Firewall}},
year = {2026},
howpublished = {\url{https://openvapt.com/checks/NET-FW-001.html}},
note = {OpenVAPT Check Catalogue, version 0.1.0-alpha.6. Accessed 16 October 2026}
}
Accessed: the date shown is today's date from your own browser (the site's build date without JavaScript); change it to the day you read the page.
Citing OpenVAPT does not mean OpenVAPT endorses, approves or has reviewed your work.