Disable Kernel Parameter for IPv4 Forwarding By Default
Forces net.ipv4.conf.default.forwarding to 0 so newly created IPv4 interfaces do not forward packets between networks by default.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
IP forwarding lets the kernel pass packets from one interface to another, turning the host into a router. Only systems intended to route traffic should do this. On an ordinary host, forwarding can let an attacker bounce traffic across network boundaries, bypass segmentation, and use the machine as a pivot. The default template should be 0 so newly created interfaces do not forward packets unless the host is explicitly configured as a router.
What Pavois checks
Pavois reads the live runtime value of net.ipv4.conf.default.forwarding from the kernel (InSpec kernel_parameter, equivalent to sysctl), not a /etc/sysctl.d/ file. Forwarding is frequently toggled at runtime by container runtimes, libvirt, or VPN software, so a config file can disagree with reality. Only the effective parameter reveals whether the kernel will actually route traffic.
describe kernel_parameter('net.ipv4.conf.default.forwarding') do
its('value') { should cmp 0 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv4.conf.default.forwarding[[:space:]]*=[[:space:]]*0([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv4.conf.default.forwarding. Expected output:
net.ipv4.conf.default.forwarding = 0
Inspect & investigate
No dedicated log exists. Inspect the state with sysctl net.ipv4.conf.default.forwarding and check the global toggle with sysctl net.ipv4.ip_forward; review all forwarding values with sysctl -a | grep forwarding.
Remediation
Pavois's harden plan uses the sysctl resource to set net.ipv4.conf.default.forwarding to 0, applying it to the running kernel and persisting it in a Pavois-managed drop-in under /etc/sysctl.d/ so it survives reboot. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv4.conf.default.forwarding |
|---|---|
| resource | sysctl |
| value | 0 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Apply with care on hosts that route traffic. Disabling forwarding will break any machine that acts as a router, NAT gateway, VPN concentrator, or container/VM host that relies on packet forwarding (Docker, Kubernetes, libvirt, WireGuard). On such systems, leave forwarding enabled or scope the exception. Before applying, confirm the host is not a router (sysctl net.ipv4.ip_forward and your network role). On a plain server with a single network role, setting this to 0 is safe and does not affect inbound remote access.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 3.3.1.3 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.