Disable Kernel Parameter for IPv6 Forwarding by default
Prevents new IPv6 interfaces from routing packets between interfaces by setting net.ipv6.conf.default.forwarding = 0.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
IPv6 forwarding lets the kernel pass packets from one interface to another, turning the host into a router. This capability is only appropriate for systems explicitly acting as routers or gateways. On an ordinary host or server, leaving forwarding enabled is unnecessary functionality that can be abused to relay traffic, bypass network segmentation or pivot between networks. Disabling it by default keeps the host from inadvertently routing traffic between networks.
What Pavois checks
Pavois reads the effective kernel value of net.ipv6.conf.default.forwarding, not a config file. The live value merges /etc/sysctl.conf, drop-ins in /etc/sysctl.d/ and /run/sysctl.d/, kernel boot parameters and any runtime sysctl -w (container runtimes, libvirt and firewalld can flip forwarding at runtime). A clean file can hide a kernel that still forwards; Pavois reports the enforced value.
describe kernel_parameter('net.ipv6.conf.default.forwarding') do
its('value') { should cmp 0 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv6.conf.default.forwarding[[:space:]]*=[[:space:]]*0([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv6.conf.default.forwarding and confirm the output is net.ipv6.conf.default.forwarding = 0. Check the global toggle too with sysctl net.ipv6.conf.all.forwarding.
Inspect & investigate
No dedicated log. Inspect runtime state with sysctl net.ipv6.conf.default.forwarding and sysctl -a | grep forwarding. To find which file set it, run sysctl --system 2>&1 | grep forwarding. Note that enabling forwarding also disables accept_ra semantics on those interfaces.
Remediation
Pavois's harden plan uses the sysctl resource to set net.ipv6.conf.default.forwarding = 0, persisting it in a managed drop-in and applying it live. Run pavois harden apply to enforce it; it is re-applied at boot via the persisted entry.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv6.conf.default.forwarding |
|---|---|
| resource | sysctl |
| value | 0 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Critical on systems that are meant to route IPv6, routers, gateways, VPN concentrators, container/VM hosts using IPv6 NAT or bridging, and Kubernetes nodes, where disabling forwarding will break inter-network traffic, container connectivity or VPN routing. Do NOT apply this rule on such systems. On ordinary hosts and servers it is safe and recommended. Before applying, confirm the host is not a router and that no container/VM networking depends on IPv6 forwarding.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 3.3.2.2 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.