lacework-global-269
4.6 Ensure That IP Forwarding Is Not Enabled on Instances (Automated)
Profile Applicability
• Level 1
Description
Compute Engine instance cannot forward a packet unless the source IP address of the packet matches the IP address of the instance. Similarly, GCP won't deliver a packet whose destination IP address is different than the IP address of the instance receiving the packet. However, both capabilities are required if you want to use instances to help route packets.
Forwarding of data packets should be disabled to prevent data loss or information disclosure.
Rationale
Compute Engine instance cannot forward a packet unless the source IP address of the packet matches the IP address of the instance. Similarly, GCP won't deliver a packet whose destination IP address is different than the IP address of the instance receiving the packet. However, both capabilities are required if you want to use instances to help route packets.
To enable this source and destination IP check, disable the canIpForward
field, which allows an instance to send and receive packets with non-matching destination or source IPs.
Impact
Deleting instance(s) acting as routers/packet forwarders may break the network connectivity.
Audit
From Console:
- Go to the
VM Instances
page by visiting: https://console.cloud.google.com/compute/instances. - For every instance, click on its name to go to the
VM instance details
page. - Under the
Network interfaces
section, ensure thatIP forwarding
is set toOff
for every network interface.
From Command Line:
- List all instances:
gcloud compute instances list --format='table(name,canIpForward)'
- Ensure that
CAN_IP_FORWARD
column in the output of above command does not containTrue
for any VM instance.
Exception: Instances created by GKE should be excluded because they need to have IP forwarding enabled and cannot be changed. Instances created by GKE have names that start with "gke-".
Remediation
You only edit the canIpForward
setting at instance creation time. Therefore, you need to delete the instance and create a new one where canIpForward
is set to false
.
From Console:
- Go to the
VM Instances
page by visiting: https://pantheon.corp.google.com/compute/instances. - Select the
VM Instance
you want to remediate. - Click the
Delete
button. - On the 'VM Instances' page, click `CREATE INSTANCE'.
- Create a new instance with the desired configuration. By default, the instance is configured to not allow IP forwarding.
From Command Line:
- Delete the instance:
gcloud compute instances delete INSTANCE_NAME
- Create a new instance to replace it, with
IP forwarding
set toOff
gcloud compute instances create
References
https://cloud.google.com/vpc/docs/using-routes#canipforward
Additional Information
You can only set the canIpForward
field at instance creation time. After an instance is created, the field becomes read-only.