Description: nftables is a subsystem of the Linux kernel providing filtering and classification of network packets/datagrams/frames and is the successor to iptables. nftables are installed as a dependency with firewalld. Rationale: Running firewalld and nftables concurrently may lead to conflict, therefore nftables should be stopped and masked when using firewalld. Audit: Run the following commend to verify that nftables is not enabled: # systemctl is-enabled nftables (disabled|masked) Run the following command to verify that iptables is not running: # systemctl status nftables Output should include: Loaded: masked (/dev/null; bad) Active: inactive (dead) Remediation: Run the following command to mask and stop nftables systemctl --now mask nftables Notes: firewalld is dependent on nftables. nftables should be stopped and disabled.

[yes/no]

Run the following command to mask and stop nftables systemctl --now mask nftables