Control: GCP > CIS v2.0 > 4 - Virtual Machines > 4.06 - Ensure That IP Forwarding Is Not Enabled on Instances

Configures auditing against a CIS Benchmark item.

Level: 1

Compute Engine instance cannot forward a packet unless the source IP address of the packet matches the IP address of the instance. Similarly, GCP won't deliver a packet whose destination IP address is different than the IP address of the instance receiving the packet. However, both capabilities are required if you want to use instances to help route packets.

Forwarding of data packets should be disabled to prevent data loss or information disclosure.

Resource Types

This control targets the following resource types:

GCP > Compute Engine > Instance

Primary Policies

The following policies can be used to configure this control:

4.06 - Ensure That IP Forwarding Is Not Enabled on Instances

In Your Workspace

Developers

Control Type URI

tmod:@turbot/gcp-cisv2-0#/control/types/r0406

Category URI

tmod:@turbot/cis#/control/categories/v071101

GraphQL

query controlType(id: "tmod:@turbot/gcp-cisv2-0#/control/types/r0406") { … }

query controls(filter: "controlTypeId:'tmod:@turbot/gcp-cisv2-0#/control/types/r0406'") { … }

CLI

Get Controls

turbot graphql controls --filter "controlTypeId:tmod:@turbot/gcp-cisv2-0#/control/types/r0406"