Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces
Stops the host from routing packets between interfaces by setting net.ipv4.ip_forward to 0.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
IP forwarding turns the host into a router that relays packets between interfaces. On a system that is not meant to route, enabling it lets an attacker pivot traffic across network segments and bypass segmentation controls, and it can leak internal topology. It must stay disabled unless the host is an intentional gateway.
What Pavois checks
Pavois reads the live value via kernel_parameter('net.ipv4.ip_forward'), reflecting the running kernel after all sysctl.conf / /etc/sysctl.d/ drop-ins and runtime sysctl -w are merged. This matters because tools like Docker, libvirt or a VPN can flip ip_forward to 1 at runtime, only the effective value exposes that, never /etc/sysctl.conf.
describe kernel_parameter('net.ipv4.ip_forward') do
its('value') { should cmp 0 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv4.ip_forward[[:space:]]*=[[:space:]]*0([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv4.ip_forward and expect net.ipv4.ip_forward = 0.
Inspect & investigate
Confirm with sysctl net.ipv4.ip_forward. If it keeps flipping back to 1, find the culprit: check for a running container engine or VPN, and inspect drop-ins with sysctl --system 2>&1 | grep ip_forward and grep -r ip_forward /etc/sysctl.conf /etc/sysctl.d/.
Remediation
Pavois's harden plan sets net.ipv4.ip_forward = 0 via the sysctl resource, persisting it in a Pavois-owned drop-in and applying it live (no reboot). Run it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv4.ip_forward |
|---|---|
| resource | sysctl |
| value | 0 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
High-impact if misapplied. Do NOT apply this on a machine that must route: routers, NAT gateways, VPN concentrators, Kubernetes nodes, Docker/Podman hosts with bridged networking, or libvirt/KVM hypervisors all need ip_forward = 1. Disabling it there breaks container/VM/inter-subnet connectivity. Precaution: confirm the host is a plain endpoint before applying; if it runs container or virtualization workloads, exclude this rule (those platforms commonly re-enable it anyway).
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R12 | direct | 2.0 | high |
| CIS | 1.4.3, 3.3.1, 3.3.1.1 | direct | per OS, see the benchmark table | high |
| NIST | 3.1.20, CM-6(a), CM-7(a), CM-7(b), SC-5, SC-7(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 1.4.3 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.