Back to Checks
linode

Linode Cloud Firewall default outbound policy is DROP

networking_firewall_default_outbound_policy_drop
Service: networkingSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:NotDefined

Linode Cloud Firewalls apply a default outbound policy to egress traffic that matches no explicit rule. This check verifies the default is set to DROP, enforcing default-deny egress so that only approved outbound connections are allowed to leave the instance.

Prowler logoProwlerprowler-provider-linode

Risk

An outbound default of ACCEPT permits unrestricted egress from the instance. If a host is compromised, this eases data exfiltration and command-and-control (C2) communication and lets malware reach arbitrary external endpoints, harming confidentiality and enabling lateral movement.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler linode --checks networking_firewall_default_outbound_policy_drop

Recommendation

Set the default outbound policy to DROP and allow only explicit outbound destinations and services.

Remediation

Other

1Log in to the Linode Cloud Manager
2Navigate to Firewalls
3Select the associated firewall
4In the Rules tab, set the default outbound policy to DROP

Check Code

from prowler.lib.check.models import Check, CheckReportLinode
from prowler.providers.linode.services.networking.networking_client import (
    networking_client,
)


class networking_firewall_default_outbound_policy_drop(Check):
    """Check if Linode Cloud Firewall default outbound policy is DROP."""

    def execute(self) -> list[CheckReportLinode]:
        """Execute the networking_firewall_default_outbound_policy_drop check.

        Iterates over all Cloud Firewalls and checks whether the default
        outbound policy is DROP.

        Returns:
            list[CheckReportLinode]: A list of findings for each firewall.
        """
        findings = []

        for fw in networking_client.firewalls:
            report = CheckReportLinode(
                metadata=self.metadata(),
                resource=fw,
                resource_name=fw.label,
                resource_id=str(fw.id),
                region="global",
            )
            report.resource_tags = fw.tags

            if fw.outbound_policy == "DROP":
                report.status = "PASS"
                report.status_extended = (
                    f"Firewall '{fw.label}' has default outbound policy set to DROP."
                )
            else:
                report.status = "FAIL"
                report.status_extended = f"Firewall '{fw.label}' has default outbound policy set to {fw.outbound_policy}."

            findings.append(report)

        return findings

References