Ensure net.ipv4.conf.default.forwarding is set to 0

Description

The kernel parameter net.ipv4.conf.default.forwarding must be 0 on hosts that are not routers, so new interfaces do not forward ipv4 packets by default.

Rationale

Packet forwarding on a non-router host can bridge networks, bypass segmentation, or relay attack traffic. The per-interface default must be disabled unless the system is an authorized router.

Framework references