---
title: Install firewalld Package
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > Install firewalld Package
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Install firewalld Package
 
## Description{% #description %}

The `firewalld` package can be installed with the following command:

```
$ sudo yum install firewalld
```

When `var_firewall_accept_other_utility` is true, as in the CIS profiles, a host where nftables or iptables is in use passes as well.

## Rationale{% #rationale %}

"Firewalld" provides an easy and effective way to block/limit remote access to the system via ports, services, and protocols. Remote access services, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and make remote user access management difficult at best. Remote access is access to nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Red Hat Enterprise Linux 8 functionality (e.g., SSH) must be capable of taking enforcement action if the audit reveals unauthorized activity. Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets)."

## Remediation{% #remediation %}

### Shell script{% #shell-script %}

The following script can be run on the host to remediate the issue.

```bash
#!/bin/bash

# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel-core; then

var_firewall_accept_other_utility='true'

firewall_other_utility_in_use=false
if rpm --quiet -q nftables && { compgen -G '/etc/systemd/system/*.wants/nftables.service' > /dev/null; }; then
    firewall_other_utility_in_use=true
fi
if rpm --quiet -q iptables-services && { compgen -G '/etc/systemd/system/*.wants/iptables.service' > /dev/null || compgen -G '/etc/systemd/system/*.wants/ip6tables.service' > /dev/null; }; then
    firewall_other_utility_in_use=true
fi

if [ "$var_firewall_accept_other_utility" != "true" ] || [ "$firewall_other_utility_in_use" != "true" ]; then
    if ! rpm -q --quiet "firewalld" ; then
    yum install -y "firewalld"
fi
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi
```

### Ansible playbook{% #ansible-playbook %}

The following playbook can be run with Ansible to remediate the issue.

```gdscript3
- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CCE-82998-6
  - DISA-STIG-RHEL-08-040100
  - NIST-800-171-03.13.01
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_firewalld_installed
- name: XCCDF Value var_firewall_accept_other_utility # promote to variable
  set_fact:
    var_firewall_accept_other_utility: !!str true
  tags:
    - always

- name: Install firewalld Package - Gather the package facts
  ansible.builtin.package_facts:
    manager: auto
  when:
  - '"kernel-core" in ansible_facts.packages'
  - var_firewall_accept_other_utility | bool
  tags:
  - CCE-82998-6
  - DISA-STIG-RHEL-08-040100
  - NIST-800-171-03.13.01
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_firewalld_installed

- name: Install firewalld Package - Find the enabled services of other firewall utilities
  ansible.builtin.find:
    paths: /etc/systemd/system
    recurse: true
    file_type: link
    patterns:
    - nftables.service
    - iptables.service
    - ip6tables.service
  register: firewall_other_utility_links
  when:
  - '"kernel-core" in ansible_facts.packages'
  - var_firewall_accept_other_utility | bool
  tags:
  - CCE-82998-6
  - DISA-STIG-RHEL-08-040100
  - NIST-800-171-03.13.01
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_firewalld_installed

- name: Install firewalld Package - Ensure firewalld is installed
  ansible.builtin.package:
    name: firewalld
    state: present
  when:
  - '"kernel-core" in ansible_facts.packages'
  - not (var_firewall_accept_other_utility | bool and ( ("nftables" in ansible_facts.packages
    and firewall_other_utility_links.files | map(attribute="path") | select("search",
    "[.]wants/(nftables)[.]service$") | list | length > 0) or ("iptables-services"
    in ansible_facts.packages and firewall_other_utility_links.files | map(attribute="path")
    | select("search", "[.]wants/(iptables|ip6tables)[.]service$") | list | length
    > 0) ))
  tags:
  - CCE-82998-6
  - DISA-STIG-RHEL-08-040100
  - NIST-800-171-03.13.01
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_firewalld_installed
```