# Ensure ip forwarding is disabled

Necessity: IP forwarding allows a system to act as a router, passing packets between different network interfaces. If a host is not intended to be a router, enabling this feature can create a severe security risk. A compromised machine with IP forwarding enabled could be used by an attacker to pivot into other, otherwise isolated, network segments, drastically expanding the scope of a breach. Disabling it is a critical step in network segmentation and reducing the system's attack surface. Auditing and Remediation: The audit script directly queries the kernel's current value for the 'net.ipv4.ip_forward' parameter. The remediation script sets this value to '0' (disabled) for the running system and also writes the setting to a configuration file to ensure it persists after a reboot. Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is '0' (disabled). This is a binary setting with a clear security implication; a system should either be a router or it should not. For any system not explicitly designated as a router, the only secure configuration is to have IP forwarding disabled. There is no intermediate or 'more secure' state than 'disabled', hence it is the universal recommendation across all hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['0']` |
| **Moderate** | `['0']` |
| **Strict** | `['0']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that executes `sysctl -n net.ipv4.ip_forward` to retrieve the current state of IP forwarding. The script must output only the raw value ('0' for disabled, '1' for enabled) without any additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument ('0' for disabled, '1' for enabled). The script must set the runtime kernel parameter using `sysctl -w net.ipv4.ip_forward=$1` and ensure the setting persists across reboots by adding or updating the line `net.ipv4.ip_forward = $1` in a file within `/etc/sysctl.d/`. The script must output 'true' upon successful application of the setting, and 'false' otherwise.

