IP Forwarding Should Be Disabled
More Info:
IP forwarding should be disabled on all instances. This ensures that the instance sends and receives packets with matching destination or source IPs.Risk Level
MediumAddress
Security, ReliabilityCompliance Standards
SOC2, CISGCP, CBP, NISTCSF, PCIDSSTriage and Remediation
Remediation
Using Console
Using Console
To remediate the IP forwarding misconfiguration in GCP using the GCP console, follow these steps:
- Open the GCP console and select the project where the misconfiguration needs to be remediated.
- In the left navigation pane, select “Compute Engine” and then select “VM instances”.
- Select the VM instance where IP forwarding needs to be disabled.
- Click on the “Edit” button at the top of the page.
- Scroll down to the “Network interfaces” section and select the network interface where IP forwarding needs to be disabled.
- In the “Network interface details” section, uncheck the “Enable IP forwarding” checkbox.
- Click on the “Save” button at the bottom of the page to save the changes.
- Repeat steps 3-7 for any other VM instances where IP forwarding needs to be disabled.
Using CLI
Using CLI
To remediate the IP forwarding misconfiguration for GCP using GCP CLI, follow these steps:Replace [SUBNET_NAME] with the name of the subnet where you want to disable IP forwarding.This command should return “False” if IP forwarding is disabled.
- Open the Google Cloud Console and select the project where the misconfiguration exists.
- Open the Cloud Shell by clicking on the icon in the top right corner of the console.
- In the Cloud Shell, run the following command to disable IP forwarding for all instances in the default network:
- If you have custom networks or subnets, run the following command to disable IP forwarding for those:
- Verify that IP forwarding is disabled by running the following command:
- Repeat steps 4 and 5 for all other custom subnets in your project.
Using Python
Using Python
To remediate the IP Forwarding misconfiguration in GCP using Python, you can use the following steps:Note: Make sure to replace the
- Import the necessary libraries:
- Set up the credentials:
- Get the current status of IP Forwarding:
- If IP Forwarding is enabled, disable it:
- Verify that IP Forwarding has been disabled by checking the current status again:
project, zone, and instance variables with your own values.