Back to Checks
linode

Linode Cloud Firewall default inbound policy is DROP

networking_firewall_default_inbound_policy_drop
Service: networkingSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:NotDefined

Linode Cloud Firewalls apply a default inbound policy to ingress traffic that does not match any explicit rule. This check verifies the default is set to DROP, enforcing a default-deny posture so that only traffic intentionally permitted by a rule is allowed in.

Prowler logoProwlerprowler-provider-linode

Risk

When the default inbound policy is ACCEPT instead of DROP, any traffic not explicitly denied by a rule is permitted. This default-allow posture can silently expose services, management ports, and unintended endpoints to the internet, enlarging the attack surface and increasing the risk of unauthorized access.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler linode --checks networking_firewall_default_inbound_policy_drop

Recommendation

Set the default inbound policy to DROP and allow only explicitly required inbound traffic.

Remediation

Other

1Log in to the Linode Cloud Manager
2Navigate to Firewalls
3Select the associated firewall
4In the Rules tab, set the default inbound policy to DROP

Check Code

from prowler.lib.check.models import Check, CheckReportLinode
from prowler.providers.linode.services.networking.networking_client import (
    networking_client,
)


class networking_firewall_default_inbound_policy_drop(Check):
    """Check if Linode Cloud Firewall default inbound policy is DROP."""

    def execute(self) -> list[CheckReportLinode]:
        """Execute the networking_firewall_default_inbound_policy_drop check.

        Iterates over all Cloud Firewalls and checks whether the default
        inbound policy is DROP.

        Returns:
            list[CheckReportLinode]: A list of findings for each firewall.
        """
        findings = []

        for fw in networking_client.firewalls:
            report = CheckReportLinode(
                metadata=self.metadata(),
                resource=fw,
                resource_name=fw.label,
                resource_id=str(fw.id),
                region="global",
            )
            report.resource_tags = fw.tags

            if fw.inbound_policy == "DROP":
                report.status = "PASS"
                report.status_extended = (
                    f"Firewall '{fw.label}' has default inbound policy set to DROP."
                )
            else:
                report.status = "FAIL"
                report.status_extended = f"Firewall '{fw.label}' has default inbound policy set to {fw.inbound_policy}."

            findings.append(report)

        return findings

References