Skip to main content

🛡️ Google GCE Instance IP Forwarding is not disabled.🟢

Logic​

Similar Policies​

Description​

Open File

Description​

Compute Engine instance cannot forward a packet unless the source IP address of the packet matches the IP address of the instance. Similarly, GCP won't deliver a packet whose destination IP address is different than the IP address of the instance receiving the packet. However, both capabilities are required if you want to use instances to help route packets.

Forwarding of data packets should be disabled to prevent data loss or information disclosure.

Rationale​

Compute Engine instance cannot forward a packet unless the source IP address of the packet matches the IP address of the instance. Similarly, GCP won't deliver a packet whose destination IP address is different than the IP address of the instance receiving the packet. However, both capabilities are required if you want to use instances to help route packets. To enable this source and destination IP check, disable the canIpForward field, which allows an instance to send and receive packets with non-matching destination or source IPs.

Impact​

... see more

Remediation​

Open File

Remediation​

You only edit the canIpForward setting at instance creation time. Therefore, you need to delete the instance and create a new one where canIpForward is set to false.

From Google Cloud Console​

  1. Go to the VM Instances page by visiting: https://console.cloud.google.com/compute/instances.
  2. Select the VM Instance you want to remediate.
  3. Click the Delete button.
  4. On the VM Instances page, click CREATE INSTANCE.
  5. Create a new instance with the desired configuration. By default, the instance is configured to not allow IP forwarding.

From Google Cloud CLI​

  1. Delete the instance:

         gcloud compute instances delete INSTANCE_NAME

  2. Create a new instance to replace it, with IP forwarding set to Off

         gcloud compute instances create

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 CIS GCP v1.2.0 → 💼 4.6 Ensure that IP forwarding is not enabled on Instances - Level 1 (Automated)1no data
💼 CIS GCP v1.3.0 → 💼 4.6 Ensure That IP Forwarding Is Not Enabled on Instances - Level 1 (Automated)1no data
💼 CIS GCP v2.0.0 → 💼 4.6 Ensure That IP Forwarding Is Not Enabled on Instances - Level 1 (Automated)1no data
💼 CIS GCP v3.0.0 → 💼 4.6 Ensure That IP Forwarding Is Not Enabled on Instances - Level 1 (Automated)1no data
💼 Cloudaware Framework → 💼 Secure Access57no data
💼 FedRAMP High Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)10850no data
💼 FedRAMP Low Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)35no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)744no data
💼 NIST CSF v1.1 → 💼 ID.AM-3: Organizational communication and data flows are mapped48no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events145no data
💼 NIST CSF v2.0 → 💼 ID.AM-03: Representations of the organization's authorized network communication and internal and external network data flows are maintained69no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected148no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected125no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected142no data
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage95no data
💼 NIST SP 800-53 Revision 4 → 💼 CA-9 INTERNAL SYSTEM CONNECTIONS11no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7 Boundary Protection29452no data
💼 PCI DSS v3.2.1 → 💼 1.1 Establish and implement firewall and router configuration standards7139no data
💼 PCI DSS v3.2.1 → 💼 1.3 Prohibit direct public access between the Internet and any system component in the cardholder data environment.7830no data
💼 PCI DSS v4.0.1 → 💼 1.2.1 Configuration standards for NSC rulesets are defined, implemented, maintained.34no data
💼 PCI DSS v4.0.1 → 💼 1.4.1 NSCs are implemented between trusted and untrusted networks.19no data
💼 PCI DSS v4.0 → 💼 1.2.1 Configuration standards for NSC rulesets are defined, implemented, maintained.2434no data
💼 PCI DSS v4.0 → 💼 1.4.1 NSCs are implemented between trusted and untrusted networks.719no data
💼 SOC 2 → 💼 CC6.6-1 Restricts Access1619no data
💼 SOC 2 → 💼 CC6.6-4 Implements Boundary Protection Systems4no data