Network misconfigurations

Vm instance with IP forwarding enabled

Risk Level

Informational (4)

Platform(s)
Compliance Frameworks

Description

Vm instance cannot forward a packet unless the source IP address of the packet matches the IP address of the instance. Similarly, GCP won't deliver a packet whose destination IP address is different than the IP address of the instance receiving the packet. However, both capabilities are required if you want to use instances to help route packets. Forwarding of data packets should be disabled to prevent data loss or information disclosure.
  • Recommended Mitigation

    Ensure that IP forwarding is disabled. You can only edit the canIpForward setting instance on creation time, therefore you need to delete the old instance and create a new one.