📝 Google GCE Instance IP Forwarding is not disabled. 🟢

• Contextual name: 📝 Instance IP Forwarding is not disabled. 🟢
• ID: /ce/ca/google/compute-engine/disable-instance-ip-forwarding
• Located in: 📁 Google GCE

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Similar Policies

• Cloud Conformity
  • Disable IP Forwarding for Virtual Machine Instances

Logic

• 🧠 prod.logic.yaml 🟢
  • 📕 Google GCE Instance
  • 🔌 Google GCE Instance - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Compute Engine instance cannot forward a packet unless the source IP address of the packet matches the IP address of the instance. Similarly, GCP won't deliver a packet whose destination IP address is different than the IP address of the instance receiving the packet. However, both capabilities are required if you want to use instances to help route packets.

Forwarding of data packets should be disabled to prevent data loss or information disclosure.

Rationale

Compute Engine instance cannot forward a packet unless the source IP address of the packet matches the IP address of the instance. Similarly, GCP won't deliver a packet whose destination IP address is different than the IP address of the instance receiving the packet. However, both capabilities are required if you want to use instances to help route packets. To enable this source and destination IP check, disable the canIpForward field, which allows an instance to send and receive packets with non-matching destination or source IPs.

Impact

... see more

Remediation

Open File

Remediation

You only edit the canIpForward setting at instance creation time. Therefore, you need to delete the instance and create a new one where canIpForward is set to false.

From Google Cloud Console

1. Go to the VM Instances page by visiting: https://console.cloud.google.com/compute/instances.
2. Select the VM Instance you want to remediate.
3. Click the Delete button.
4. On the VM Instances page, click CREATE INSTANCE.
5. Create a new instance with the desired configuration. By default, the instance is configured to not allow IP forwarding.

From Google Cloud CLI

1. Delete the instance:

        gcloud compute instances delete INSTANCE_NAME

2. Create a new instance to replace it, with IP forwarding set to Off

        gcloud compute instances create

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 CIS GCP v3.0.0 → 💼 4.6 Ensure That IP Forwarding Is Not Enabled on Instances - Level 1 (Automated)			1
💼 Cloudaware Framework → 💼 Secure Access			43