Description: In ip6tables the default policy is applied only after all the applicable rules in the table are examined for a match. Setting the default policy to DROP implements proper design for a firewall, i.e. any packets which are not explicitly permitted should not be accepted. Fix: To set the default policy to DROP (instead of ACCEPT) using ip6tables for the built-in FORWARD chain which processes incoming packets, check and run the following steps: #yum remove -y firewalld #yum install -y iptables iptables-services #systemctl enable ip6tables #ip6tables -P FORWARD DROP #service ip6tables save Note: In the presence of firewalld package, iptables rules cannot be set as permanent. But removing firewalld package will lead to the removal of all rules currently configured in the machine. So patch is not provided for the rule.

[yes/no]

In 'iptables', the default policy is applied only after all the applicable rules in the table are examined for a match. Setting the default policy to 'DROP' implements proper design for a firewall, i.e. any packets which are not explicitly permitted should not be accepted.