# 4.6 Ensure That IP Forwarding Is Not Enabled on Instances (Automated)

- Source: https://support.icompaas.com/support/solutions/articles/62000233020-4-6-ensure-that-ip-forwarding-is-not-enabled-on-instances-automated-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Profile Applicability:

Level 1

Description:

Google Compute Engine instances are restricted from forwarding packets unless the source and destination IP addresses match the instance's own IP address. IP forwarding allows instances to act as routers, which could lead to potential data loss or unauthorized data disclosure. To ensure enhanced security, instances should have IP forwarding disabled.

Rationale:

Disabling IP forwarding enforces source and destination IP checks, ensuring instances cannot route packets with mismatched IPs. This prevents misuse of instances as routers or packet forwarders, reducing risks of information leakage and enhancing network security.

Impact:

Disabling IP forwarding may affect instances configured to act as routers or forward packets, potentially disrupting network connectivity. Review network requirements carefully before implementing this change

Default Value:

By default, Compute Engine instances are not configured to allow IP forwarding..

Audit Steps:

#### From Google Cloud Console:

1.  Navigate to the VM Instances page: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances).
    

                ![](https://support.icompaas.com/assets/kb/5e2e519e39fc7ee2.png)

2.  Select an instance to view its details.
    

                ![](https://support.icompaas.com/assets/kb/ba7e9df4ac2016fb.png)

3.  Under the Network Interfaces section, ensure IP forwarding is set to Off for all network interfaces.
    

  ![](https://support.icompaas.com/assets/kb/5b533d71fc69ea91.png)

#### From Google Cloud CLI:

List all VM instances and their IP forwarding settings:

gcloud compute instances list --format='table(name,canIpForward)'

1.  Verify that the CAN\_IP\_FORWARD column shows False for all instances.
    

#### Exception:

Exclude instances created by Google Kubernetes Engine (GKE), as they require IP forwarding to function. Instances created by GKE typically have names starting with gke-.

Remediation Steps:

#### From Google Cloud Console:

1.  Go to the VM Instances page: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances).
    

                       ![](https://support.icompaas.com/assets/kb/3e947ee9e5dc1775.png)

2.  Select the affected VM instance.
    

         ![](https://support.icompaas.com/assets/kb/b3fcd451a165901a.png)

3.  Click Delete to remove the instance.
    

               ![](https://support.icompaas.com/assets/kb/338383b8d8f94057.png)

4.  Create a new instance with IP forwarding disabled (default setting): 
    
    -   Click CREATE INSTANCE and configure the instance as needed.
        

    ![](https://support.icompaas.com/assets/kb/987ca828cbe9db16.png)

#### From Google Cloud CLI:

Delete the instance with IP forwarding enabled:

gcloud compute instances delete INSTANCE\_NAME

Create a new instance with IP forwarding disabled:

gcloud compute instances create INSTANCE\_NAME

References:

1.  [Using Routes in VPC](https://cloud.google.com/vpc/docs/using-routes#canipforward)
    

CIS Controls:

<table style="border:none;border-collapse:collapse;font-family:&quot;Helvetica Neue&quot;"><colgroup style="font-family:&quot;Helvetica Neue&quot;"><col style="font-family:&quot;Helvetica Neue&quot;"><col style="font-family:&quot;Helvetica Neue&quot;"><col style="font-family:&quot;Helvetica Neue&quot;"><col style="font-family:&quot;Helvetica Neue&quot;"><col style="font-family:&quot;Helvetica Neue&quot;"></colgroup><tbody style="font-family:&quot;Helvetica Neue&quot;"><tr style="height:41.5pt;font-family:&quot;Helvetica Neue&quot;"><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;"><p dir="ltr" style="line-height:1.38;text-align:center;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;"><span style="font-size:13px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-weight:700;font-family:&quot;Helvetica Neue&quot;">Control</span></span></span></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;"><p dir="ltr" style="line-height:1.38;text-align:center;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;"><span style="font-size:13px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-weight:700;font-family:&quot;Helvetica Neue&quot;">Description</span></span></span></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;"><p dir="ltr" style="line-height:1.38;text-align:center;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;"><span style="font-size:13px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-weight:700;font-family:&quot;Helvetica Neue&quot;">IG 1</span></span></span></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;"><p dir="ltr" style="line-height:1.38;text-align:center;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;"><span style="font-size:13px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-weight:700;font-family:&quot;Helvetica Neue&quot;">IG 2</span></span></span></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;"><p dir="ltr" style="line-height:1.38;text-align:center;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;"><span style="font-size:13px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-weight:700;font-family:&quot;Helvetica Neue&quot;">IG 3</span></span></span></p></td></tr><tr style="height:41.5pt;font-family:&quot;Helvetica Neue&quot;"><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;"><p dir="ltr" style="line-height:1.38;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;"><span style="font-size:13px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-family:&quot;Helvetica Neue&quot;">4.4 Implement and Manage a Firewall on Servers</span></span></span></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;"><p dir="ltr" style="line-height:1.38;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;"><strong><span style="font-size:13px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-weight:400;font-family:&quot;Helvetica Neue&quot;">Use a firewall to restrict traffic based on approved protocols and ports.</span></span></span></strong></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;"><p dir="ltr" style="line-height:1.38;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;"><strong><span style="font-size:13px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-weight:400;font-family:&quot;Helvetica Neue&quot;">✅</span></span></span></strong></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;"><p dir="ltr" style="line-height:1.38;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;"><strong><span style="font-size:13px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-weight:400;font-family:&quot;Helvetica Neue&quot;">✅</span></span></span></strong></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;"><p dir="ltr" style="line-height:1.38;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;"><strong><span style="font-size:13px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-weight:400;font-family:&quot;Helvetica Neue&quot;">✅</span></span></span></strong></p></td></tr><tr style="height:41.5pt;font-family:&quot;Helvetica Neue&quot;"><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;"><p dir="ltr" style="line-height:1.38;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;"><span style="font-size:13px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-family:&quot;Helvetica Neue&quot;">4.5 Implement and Manage a Firewall on End-User Devices</span></span></span></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;"><p dir="ltr" style="line-height:1.38;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;"><strong><span style="font-size:13px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-weight:400;font-family:&quot;Helvetica Neue&quot;">Implement host-based firewalls or port filtering tools with a default-deny rule.</span></span></span></strong></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;"><p dir="ltr" style="line-height:1.38;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;"><strong><span style="font-size:13px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-weight:400;font-family:&quot;Helvetica Neue&quot;">✅</span></span></span></strong></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;"><p dir="ltr" style="line-height:1.38;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;"><strong><span style="font-size:13px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-weight:400;font-family:&quot;Helvetica Neue&quot;">✅</span></span></span></strong></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;"><p dir="ltr" style="line-height:1.38;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;"><strong><span style="font-size:13px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-weight:400;font-family:&quot;Helvetica Neue&quot;">✅</span></span></span></strong></p></td></tr><tr style="height:41.5pt;font-family:&quot;Helvetica Neue&quot;"><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;"><p dir="ltr" style="line-height:1.38;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;"><span style="font-size:13px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-family:&quot;Helvetica Neue&quot;">11.1 Maintain Standard Security Configurations</span></span></span></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;"><p dir="ltr" style="line-height:1.38;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;"><strong><span style="font-size:13px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-weight:400;font-family:&quot;Helvetica Neue&quot;">Maintain secure and documented configurations for all network devices.</span></span></span></strong></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;"><p dir="ltr" style="line-height:1.38;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;"><strong><span style="font-size:13px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-weight:400;font-family:&quot;Helvetica Neue&quot;">✅</span></span></span></strong></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;"><p dir="ltr" style="line-height:1.38;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;"><strong><span style="font-size:13px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-weight:400;font-family:&quot;Helvetica Neue&quot;">✅</span></span></span></strong></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;"><strong><span style="font-size:13px"><span style="font-family:Helvetica Neue"><br style="font-family:&quot;Helvetica Neue&quot;"></span></span></strong></td></tr><tr style="height:56.5pt;font-family:&quot;Helvetica Neue&quot;"><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;"><p dir="ltr" style="line-height:1.38;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;"><span style="font-size:13px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-family:&quot;Helvetica Neue&quot;">11.2 Document Traffic Configuration Rules</span></span></span></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;"><p dir="ltr" style="line-height:1.38;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;"><strong><span style="font-size:13px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-weight:400;font-family:&quot;Helvetica Neue&quot;">Ensure traffic rules are documented with business justifications and responsible owners.</span></span></span></strong></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;"><p dir="ltr" style="line-height:1.38;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;"><strong><span style="font-size:13px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-weight:400;font-family:&quot;Helvetica Neue&quot;">✅</span></span></span></strong></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;"><p dir="ltr" style="line-height:1.38;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;"><strong><span style="font-size:13px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-weight:400;font-family:&quot;Helvetica Neue&quot;">✅</span></span></span></strong></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;"><strong><span style="font-size:13px"><span style="font-family:Helvetica Neue"><br style="font-family:&quot;Helvetica Neue&quot;"></span></span></strong></td></tr></tbody></table>

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.