Detections
Analytics
3.3.1.3 Ensure net.ipv4.conf.default.forwarding is configured
Information
ICMP Redirects are used to send routing information to other hosts. As a host itself does not act as a router (in a host only configuration), there is no need to send redirects.net.ipv4.conf.default.forwarding controls forwarding of IPv4 packet on newly added network interfaces.
More information about the kernel parameter configuration files, their location, and load preference is available in the "Configure Network Kernel Parameters" section overview.
Routing protocol daemons are typically used on routers to exchange network topology information with other routers. If this capability is used when not required, system network information may be unnecessarily transmitted across the network.
Solution
- Review all files being used by systemd sysctl and comment out or remove all net.ipv4.conf.default.forwarding lines that are not net.ipv4.conf.default.forwarding=0.Example script:
#!/usr/bin/env bash
{
l_option="net.ipv4.conf.default.forwarding" l_value="0"
l_grep="${l_option//./(\\.|\\/)}" a_files=()
l_systemdsysctl="$(readlink -e /lib/systemd/systemd-sysctl \
|| readlink -e /usr/lib/systemd/systemd-sysctl)"
l_ufw_file="$([ -f /etc/default/ufw ] && \
awk -F= '/^\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)"
[ -f "$(readlink -e "$l_ufw_file")" ] && \
a_files+=("$l_ufw_file"); a_files+=("/etc/sysctl.conf")
while IFS= read -r l_fname; do
l_file="$(readlink -e "${l_fname//# /}")"
[ -n "$l_file" ] && ! grep -Psiq -- '(^|\h+)'"$l_file"'\b' \
<<< "${a_files[*]}" && a_files+=("$l_file")
done < <("$l_systemdsysctl" --cat-config | tac | \
grep -Psio -- '^\h*#\h*\/[^#\n\r\h]+\.conf\b')
for l_file in "${a_files[@]}"; do
grep -Psio -- '\h*'"$l_grep"'\h*=\h*\H+\b' "$l_file" \
| grep -Psivq -- '^\h*'"$l_grep"'\h*=\h*'"$l_value"'\b' && \
sed -ri '/^\s*'"$l_grep"'\s*=\s*(1[0-9]*)/s/^/# /' "$l_file"
done
}
- Create or edit a file in the /etc/sysctl.d/ directory ending in .conf and edit or add the following line:
net.ipv4.conf.default.forwarding = 0
Example:
# [ ! -d "/etc/sysctl.d/" ] && mkdir -p /etc/sysctl.d/
# printf '%s\n' "" "net.ipv4.conf.default.forwarding = 0" \
>> /etc/sysctl.d/60-ipv4_sysctl.conf
Note: See the Configure IPv4 parameters subsection overview for important notes on UFW sysctl file interaction.
- Run the following command to load all sysctl configuration filles:
# sysctl --system
Impact:
IP forwarding is required on systems configured to act as a router. If these parameters are disabled, the system will not be able to perform as a router.
Cloud Service Provider (CSP) hosted systems may require forwarding to be enabled. If the system is running on a CSP platform, this requirement should be reviewed before disabling IPv4 forwarding.
See Also
Item Details
Audit Name: CIS Ubuntu Linux 26.04 LTS v1.0.0 L1 Server
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6, 800-53|CM-6b., 800-53|CM-7, CSCv7|9.2
Plugin: Unix
Control ID: 055ee7c0b1932b2d0a905ce2f4532be0078d6f6351cfca954d5159e2abf90dbb