To set the default policy to DROP (instead of ACCEPT) for the built-in FORWARD chain which processes packets that will be forwarded from one interface to another, add or correct the following line in '/etc/sysconfig/iptables': ':FORWARD DROP [0:0]' [yes/no] In 'iptables', the default policy is applied only after all the applicable rules in the table are examined for a match. Setting the default policy to 'DROP' implements proper design for a firewall, i.e. any packets which are not explicitly permitted should not be accepted. oval:org.secpod.oval:def:31030 oval:org.secpod.oval:def:30307 SCAP Repo OVAL Definition 2015-11-13