Detections
Analytics

3.3.1 Ensure ip forwarding is disabled

Information

The net.inet.ip.forwarding and net.inet6.ip.forwarding flags tell the system whether it can forward packets.

In FreeBSD, there are also two other services, mainly gateway and ipv6_gateway, that enable the same behind the scenes.

Setting net.inet.ip.forwarding and net.inet6.ip.forwarding to 0 ensures that a system with multiple interfaces (for example, a hard proxy), will never be able to forward packets, and therefore, never serve as a router. Also make sure that the gateway and ipv6_gateway services are disabled.

Solution

FreeBSD ships with default disabled. Stop and disable the gateway and ipv6_gateway services.

Example:

# service gateway stop
# service gateway disable

-IF- IPv6 is enabled on the system:

Example:

# service ipv6_gateway stop
# service ipv6_gateway disable

Note: If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten

Impact:

IP forwarding is required on systems configured to act as a router. If these parameters are disabled, the system will not be able to perform as a router.

Many Cloud Service Provider (CSP) hosted systems require IP forwarding to be enabled. If the system runs on a CSP platform, this requirement should be reviewed before disabling IP forwarding.

See Also

https://workbench.cisecurity.org/benchmarks/19044

Item Details

Category: CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION

References: 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|IA-5, CSCv7|9.2

Plugin: Unix

Control ID: 70622860b65d7cfce8aa88cc5a9e32a30b20aa24c8c8e6ab79d6574072cc7fe3