Detections
Analytics
3.3.1 Ensure ip forwarding is disabled
Information
The net.ipv4.ip_forward and net.ipv6.conf.all.forwarding flags are used to tell the system whether it can forward packets or not.Setting net.ipv4.ip_forward and net.ipv6.conf.all.forwarding to 0 ensures that a system with multiple interfaces (for example, a hard proxy), will never be able to forward packets, and therefore, never serve as a router.
Solution
Set the following parameter in /etc/sysctl.conf or a file in /etc/sysctl.d/ ending in .conf :- net.ipv4.ip_forward = 0
Example:
# printf '%s\n' "net.ipv4.ip_forward = 0" >> /etc/sysctl.d/60-netipv4_sysctl.conf
Run the following script to set the active kernel parameters:
#!/usr/bin/env bash
{
sysctl -w net.ipv4.ip_forward=0
sysctl -w net.ipv4.route.flush=1
}
- IF - IPv6 is enabled on the system:
Set the following parameter in /etc/sysctl.conf or a file in /etc/sysctl.d/ ending in .conf :
- net.ipv6.conf.all.forwarding = 0
Example:
# printf '%s\n' "net.ipv6.conf.all.forwarding = 0" >> /etc/sysctl.d/60-netipv6_sysctl.conf
Run the following script to set the active kernel parameters:
#!/usr/bin/env bash
{
sysctl -w net.ipv6.conf.all.forwarding=0
sysctl -w net.ipv6.route.flush=1
}
Note: If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten
Impact:
IP forwarding is required on systems configured to act as a router. If these parameters are disabled, the system will not be able to perform as a router.
Many Cloud Service Provider (CSP) hosted systems require IP forwarding to be enabled. If the system is running on a CSP platform, this requirement should be reviewed before disabling IP forwarding.
See Also
Item Details
Category: CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION
References: 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|IA-5, CAT|II, CSCv7|9.2, Rule-ID|SV-230540r858810_rule, STIG-ID|RHEL-08-040260, Vuln-ID|V-230540
Plugin: Unix
Control ID: a634ee3d410a3b42792fa1ade11f90ef8b3ed8301694b55efeaa44aa680ba019