Show pageOld revisionsBacklinksBack to top This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong. ======3.1.1 Ensure IP forwarding is disabled (Scored)====== =====Profile Applicability===== <code> Level 1 - Server Level 1 - Workstation </code> =====Description===== The ''net.ipv4.ip_forward'' flag is used to tell the system whether it can forward packets or not. =====Rationale===== Setting the flag to 0 ensures that a system with multiple interfaces (for example, a hard proxy), will never be able to forward packets, and therefore, never serve as a router. =====Audit===== Run the following command and verify output matches: <Code:bash> # sysctl net.ipv4.ip_forward net.ipv4.ip_forward = 0 </Code> =====Remediation===== Set the following parameter in the ''/etc/sysctl.conf'' file: <Code:bash> net.ipv4.ip_forward = 0 </Code> Run the following commands to set the active kernel parameters: <Code:bash> # sysctl -w net.ipv4.ip_forward=0 # sysctl -w net.ipv4.route.flush=1 </Code> ubuntu1604/3/1/1.txt Last modified: 2017/05/04 03:40by Piotr Kłoczewski