cis-gcp-foundations-4-6

name	cis-gcp-foundations-4.6
description	Ensure That IP Forwarding Is Not Enabled on Instances
category	cis-gcp-foundations
version	4.0.0
author	cyberstrike-official
tags	["cis","gcp","compute","virtual-machines","service-accounts"]
cis_id	4.6
cis_benchmark	CIS Google Cloud Platform Foundation Benchmark v4.0.0
tech_stack	["gcp"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

4.6 Ensure That IP Forwarding Is Not Enabled on Instances (Automated)

Profile Applicability

• Level 1

Description

Compute Engine instance cannot forward a packet unless the source IP address of the packet matches the IP address of the instance. Similarly, GCP won't deliver a packet whose destination IP address is different than the IP address of the instance receiving the packet. However, both capabilities are required if you want to use instances to help route packets.

Forwarding of data packets should be disabled to prevent data loss or information disclosure.

Rationale

Compute Engine instance cannot forward a packet unless the source IP address of the packet matches the IP address of the instance. Similarly, GCP won't deliver a packet whose destination IP address is different than the IP address of the instance receiving the packet. However, both capabilities are required if you want to use instances to help route packets. To enable this source and destination IP check, disable the canIpForward field, which allows an instance to send and receive packets with non-matching destination or source IPs.

Audit

From Google Cloud Console

1. Go to the VM Instances page by visiting: https://console.cloud.google.com/compute/instances.
2. For every instance, click on its name to go to the VM instance details page.
3. Under the Network interfaces section, ensure that IP forwarding is set to Off for every network interface.

From Google Cloud CLI

1. List all instances:

gcloud compute instances list --format='table(name,canIpForward)'

2. Ensure that CAN_IP_FORWARD column in the output of above command does not contain True for any VM instance.

Exception

Instances created by GKE should be excluded because they need to have IP forwarding enabled and cannot be changed. Instances created by GKE have names that start with "gke-".

Remediation

You only edit the canIpForward setting at instance creation or using CLI.

From Google Cloud CLI

1. Use the instances export command to export the existing instance properties:

gcloud compute instances export <INSTANCE_NAME> \
    --project <PROJECT_ID> \
    --zone <ZONE> \
    --destination=<FILE_PATH>