CIS-LINUX-3.2.1
Ensure IP forwarding is disabled
MediumLevel 1Automatedlinux
Description
The net.ipv4.ip_forward flag controls whether the system forwards packets. Disable it unless the host is a router.
How it is checked
Audit method: Shell command
shell
sysctl -n net.ipv4.ip_forward- Expected output
0
How it is fixed
Fix method: Shell command
shell
sysctl -w net.ipv4.ip_forward=0Properties
- Operating systems
- ubuntu-22.04, ubuntu-24.04, rocky-9
- Tags
- networksysctl
- Reference
- CIS Ubuntu Linux / Rocky Linux Benchmarks - Ensure IP forwarding is disabled (verify section number for your release)
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target linux