Menu
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-gcp-foundations-4-6The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Showing SKILL.md
Based on SOC occupation classification
| name | cis-gcp-foundations-4.6 |
| description | Ensure That IP Forwarding Is Not Enabled on Instances |
| category | cis-gcp-foundations |
| version | 4.0.0 |
| author | cyberstrike-official |
| tags | ["cis","gcp","compute","virtual-machines","service-accounts"] |
| cis_id | 4.6 |
| cis_benchmark | CIS Google Cloud Platform Foundation Benchmark v4.0.0 |
| tech_stack | ["gcp"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Compute Engine instance cannot forward a packet unless the source IP address of the packet matches the IP address of the instance. Similarly, GCP won't deliver a packet whose destination IP address is different than the IP address of the instance receiving the packet. However, both capabilities are required if you want to use instances to help route packets.
Forwarding of data packets should be disabled to prevent data loss or information disclosure.
Compute Engine instance cannot forward a packet unless the source IP address of the packet matches the IP address of the instance. Similarly, GCP won't deliver a packet whose destination IP address is different than the IP address of the instance receiving the packet. However, both capabilities are required if you want to use instances to help route packets. To enable this source and destination IP check, disable the canIpForward field, which allows an instance to send and receive packets with non-matching destination or source IPs.
VM Instances page by visiting: https://console.cloud.google.com/compute/instances.VM instance details page.Network interfaces section, ensure that IP forwarding is set to Off for every network interface.gcloud compute instances list --format='table(name,canIpForward)'
CAN_IP_FORWARD column in the output of above command does not contain True for any VM instance.Instances created by GKE should be excluded because they need to have IP forwarding enabled and cannot be changed. Instances created by GKE have names that start with "gke-".
You only edit the canIpForward setting at instance creation or using CLI.
gcloud compute instances export <INSTANCE_NAME> \
--project <PROJECT_ID> \
--zone <ZONE> \
--destination=<FILE_PATH>
Note: Replace the following:
Use a text editor to modify this file. Replace canIpForward: true with canIpForward: false.
Run this command to import the file you just modified:
gcloud compute instances update-from-file INSTANCE_NAME \
--project PROJECT_ID \
--zone ZONE \
--source=FILE_PATH \
--most-disruptive-allowed-action=REFRESH
If the update request is valid and the required resources are available, the instance update process begins. You can monitor the status of this operation by viewing the audit logs. This update requires only a REFRESH not a full restart.
By default, instances are not configured to allow IP forwarding.
You can only set the canIpForward field at instance creation time or using CLI.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 4.4 Implement and Manage a Firewall on Servers | X | X | X |
| v8 | 4.5 Implement and Manage a Firewall on End-User Devices | X | X | X |
| v7 | 11.1 Maintain Standard Security Configurations for Network Devices | X | X | |
| v7 | 11.2 Document Traffic Configuration Rules | X | X |