Drop outgoing traffic by default

Description

Most host firewalls only filter incoming traffic. This control requires the default policy for outgoing packets to drop or reject them, so that the system can only reach the destinations and ports allowed by explicit rules (DNS, NTP, package mirrors, proxies, log collectors...):

• with ufw: deny (outgoing) or reject (outgoing) in ufw status verbose;
• with nftables (when nftables.service is enabled and ufw is not active): a base chain on the output hook with policy drop.

Rationale

An outgoing allow list stops a compromised service from downloading a second stage, reaching a command and control server or sending data out directly. Blocked attempts also show up in the firewall logs.

Impact

Every outgoing flow the system needs must be listed beforehand, including DNS, NTP, package updates and replies handled outside connection tracking. A missing rule breaks updates, time synchronization or name resolution. There is no automatic fix for this reason.

Audit

• ufw: ufw status verbose shows deny (outgoing) or reject (outgoing).
• nftables: nft list ruleset has a chain with hook output and policy drop.

Automated: every check must pass. Scanners report each check by its id.

ufw-outgoing

ufw default policy for outgoing traffic.

script: |
  ufw status 2>/dev/null | grep -q '^Status: active' || { echo 'ufw is not active'; exit 2; }
  d=$(ufw status verbose 2>/dev/null | sed -n 's/^Default: //p')
  echo "$d"
  printf '%s' "$d" | grep -Eq '(deny|reject) \(outgoing\)'

nft-output

nftables output base chain with policy drop.

script: |
  [ "$(systemctl is-enabled nftables.service 2>/dev/null)" = enabled ] || { echo 'nftables.service is not enabled'; exit 2; }
  if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q '^Status: active'; then
    echo 'ufw manages the firewall'; exit 2
  fi
  r=$(nft list ruleset 2>/dev/null) || exit 3
  if printf '%s\n' "$r" | grep -Eq 'hook output .*policy drop'; then echo 'output: policy drop'; else echo 'output: no chain with policy drop'; exit 1; fi

Remediation

1. List the outgoing flows the system needs (ss -tunp over a typical day, the configured DNS, NTP and package mirrors, proxies, log and backup servers).
2. Allow them, then change the default:
   • ufw: ufw allow out 53, ufw allow out 123/udp, ufw allow out to <mirror> port 443 proto tcp... then ufw default deny outgoing;
   • nftables: add an output base chain with policy drop;, a rule ct state established,related accept, oif lo accept and one rule per flow.
3. Check name resolution, time synchronization and apt update right after the change.

Rollback

ufw: ufw default allow outgoing. nftables: set the output chain policy back to accept and reload.

References

• ufw(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• nft(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• NIST SP 800-41 Rev. 1 - Guidelines on Firewalls and Firewall Policy NIST, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• requires CB-DEB-NET-005 Run exactly one host firewall

People and lifecycle