Ensure net.ipv4.conf.all.forwarding is set to 0

Description

The kernel parameter net.ipv4.conf.all.forwarding must be set to 0 on systems that are not routers, so the host does not forward IPv4 packets between interfaces.

Rationale

IPv4 packet forwarding on a non-router host can be abused to bridge networks, bypass segmentation controls, or relay attack traffic. It must be disabled unless the system is an authorized router.

Framework references