Control: 4.6 Ensure That IP Forwarding Is Not Enabled on Instances
Description
Compute Engine instance cannot forward a packet unless the source IP address of the packet matches the IP address of the instance. Similarly, GCP won't deliver a packet whose destination IP address is different than the IP address of the instance receiving the packet. However, both capabilities are required if you want to use instances to help route packets.
Forwarding of data packets should be disabled to prevent data loss or information disclosure.
Compute Engine instance cannot forward a packet unless the source IP address of the packet matches the IP address of the instance. Similarly, GCP won't deliver a packet whose destination IP address is different than the IP address of the instance receiving the packet. However, both capabilities are required if you want to use instances to help route packets.
To enable this source and destination IP check, disable the canIpForward
field, which allows an instance to send and receive packets with non-matching destination or source IPs.
Remediation
You only edit the canIpForward
setting at instance creation or using CLI.
From Google Cloud CLI
- Use the instances export command to export the existing instance properties:
gcloud compute instances export <INSTANCE_NAME> \--project <PROJECT_ID> \--zone <ZONE> \--destination=<FILE_PATH>
NoteReplace the following:
INSTANCE_NAME the name for the instance that you want to export.
PROJECT_ID: the project ID for this request.
ZONE: the zone for this instance.
FILE_PATH: the output path where you want to save the instance configuration file on your local workstation.
- Use a text editor to modify this file.
Replace
canIpForward: true
with
canIpForward: false
- Run this command to import the file you just modified.
gcloud compute instances update-from-file INSTANCE_NAME \--project PROJECT_ID \--zone ZONE \--source=FILE_PATH \--most-disruptive-allowed-action=REFRESH
If the update request is valid and the required resources are available, the instance update process begins. You can monitor the status of this operation by viewing the audit logs.
This update requires only a REFRESH not a full restart.
Default Value
By default, instances are not configured to allow IP forwarding.
Usage
Run the control in your terminal:
powerpipe control run gcp_compliance.control.cis_v400_4_6
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run gcp_compliance.control.cis_v400_4_6 --share
SQL
This control uses a named query:
select self_link resource, case when name like 'gke-%' and labels ? 'goog-gke-node' then 'skip' when can_ip_forward then 'alarm' else 'ok' end as status, case when name like 'gke-%' and labels ? 'goog-gke-node' then title || ' created by GKE.' when can_ip_forward then title || ' IP forwarding enabled.' else title || ' IP forwarding not enabled.' end as reason , location as location, project as projectfrom gcp_compute_instance;