# Ensure ip forwarding is disabled

Necessity: IP forwarding allows a Linux system to act as a router, forwarding network packets from one network interface to another. On a system not explicitly intended to be a router (such as a standard server or workstation), enabling IP forwarding creates a significant security risk. If compromised, an attacker could use the machine as a pivot point to bypass firewalls and access other, otherwise isolated, network segments. Disabling it enforces network segmentation and the principle of least privilege, drastically reducing the system's attack surface. Auditing and Remediation: The audit script directly queries the kernel's current setting for `net.ipv4.ip_forward`. The remediation script modifies both the live kernel parameter using `sysctl` for an immediate effect and updates the system's configuration files (e.g., in `/etc/sysctl.d/`) to ensure the setting persists across reboots. Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is `['0']` (disabled). There is no valid intermediate state for this setting on a non-router host. Any system that is not explicitly and securely configured to be a router should have this feature disabled. The security risk introduced by enabling it is binary; it either exposes the system to routing-based attacks or it does not. Therefore, the only secure configuration is to have it disabled across all hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['0']` |
| **Moderate** | `['0']` |
| **Strict** | `['0']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the value of the `net.ipv4.ip_forward` kernel parameter using the command `sysctl -n net.ipv4.ip_forward`. The script must output only the numeric value (`0` for disabled, `1` for enabled) and nothing else.

## Remediation Script Working

Bash script that accepts a single positional argument (`0` for disabled or `1` for enabled). The script must set the runtime value using `sysctl -w net.ipv4.ip_forward=$1` and also set the value persistently in a file under `/etc/sysctl.d/`. The script should create or modify the configuration to ensure the setting is applied on reboot. The script must output `true` on success and `false` on failure.

