Profile Applicability:
Level 1
Description:
Google Compute Engine instances are restricted from forwarding packets unless the source and destination IP addresses match the instance's own IP address. IP forwarding allows instances to act as routers, which could lead to potential data loss or unauthorized data disclosure. To ensure enhanced security, instances should have IP forwarding disabled.
Rationale:
Disabling IP forwarding enforces source and destination IP checks, ensuring instances cannot route packets with mismatched IPs. This prevents misuse of instances as routers or packet forwarders, reducing risks of information leakage and enhancing network security.
Impact:
Disabling IP forwarding may affect instances configured to act as routers or forward packets, potentially disrupting network connectivity. Review network requirements carefully before implementing this change
Default Value:
By default, Compute Engine instances are not configured to allow IP forwarding..
Audit Steps:
From Google Cloud Console:
Navigate to the VM Instances page: https://console.cloud.google.com/compute/instances.
Select an instance to view its details.
Under the Network Interfaces section, ensure IP forwarding is set to Off for all network interfaces.
From Google Cloud CLI:
List all VM instances and their IP forwarding settings:
gcloud compute instances list --format='table(name,canIpForward)'
Verify that the CAN_IP_FORWARD column shows False for all instances.
Exception:
Exclude instances created by Google Kubernetes Engine (GKE), as they require IP forwarding to function. Instances created by GKE typically have names starting with gke-.
Remediation Steps:
From Google Cloud Console:
Go to the VM Instances page: https://console.cloud.google.com/compute/instances.
Select the affected VM instance.
Click Delete to remove the instance.
Create a new instance with IP forwarding disabled (default setting):
Click CREATE INSTANCE and configure the instance as needed.
From Google Cloud CLI:
Delete the instance with IP forwarding enabled:
gcloud compute instances delete INSTANCE_NAME
Create a new instance with IP forwarding disabled:
gcloud compute instances create INSTANCE_NAME
References:
CIS Controls: