Disable Kernel Parameter for IPv4 Forwarding on all IPv4 Interfaces
Sets net.ipv4.conf.all.forwarding=0 so a non-router host does not route packets between its interfaces.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
IP forwarding lets the kernel route packets from one interface to another, turning the host into a router. On a system that is not meant to route, leaving forwarding enabled lets an attacker who gains a foothold use the host as a pivot to reach networks it bridges, bypassing segmentation and firewalls. Setting net.ipv4.conf.all.forwarding=0 ensures the host only handles traffic addressed to itself. Forwarding should be enabled only on machines whose explicit role is routing (gateways, NAT boxes, container/VM hosts).
What Pavois checks
Pavois reads the live kernel value via kernel_parameter('net.ipv4.conf.all.forwarding') and asserts it equals 0. Whether the host actually forwards traffic depends on the running kernel value, and tools like Docker, libvirt or a started VPN frequently flip this on at runtime, regardless of what sysctl.d files say. Reading the effective value catches that drift; a file-based scanner that only inspects config would falsely report forwarding as disabled.
describe kernel_parameter('net.ipv4.conf.all.forwarding') do
its('value') { should cmp 0 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv4.conf.all.forwarding[[:space:]]*=[[:space:]]*0([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv4.conf.all.forwarding (equivalently sysctl net.ipv4.ip_forward). Expected output:
net.ipv4.conf.all.forwarding = 0
Inspect & investigate
sysctl net.ipv4.conf.all.forwardingshows the current value.cat /proc/sys/net/ipv4/ip_forwardis the raw global toggle.- To find what re-enabled it, check
systemctl status docker libvirtdand any VPN/firewalldmasquerade unit; many of these set forwarding when they start.
Remediation
Pavois's harden plan uses the sysctl resource to set net.ipv4.conf.all.forwarding to 0. It writes the key into a Pavois-managed drop-in and reloads it so forwarding is disabled immediately and persistently. Apply it with pavois harden apply. Note: a service that needs routing may re-enable it at runtime, so re-scan after starting such services.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv4.conf.all.forwarding |
|---|---|
| resource | sysctl |
| value | 0 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Disabling forwarding breaks any routing role. Do not apply (or explicitly exclude) hosts that are gateways, NAT/VPN endpoints, Kubernetes nodes, or Docker/libvirt hosts, those require forwarding for container/VM networking and will lose connectivity for their guests. Before applying, confirm the host's only job is to be an endpoint. On such endpoint servers there is no impact and no remote-access lockout, since their own inbound/outbound SSH does not require forwarding.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 3.3.1.2 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.