mediumnetworkverified ✓rollback-safe
Ensure net.ipv6.conf.default.forwarding is set to 0
sysctl-net-ipv6-conf-default-forwarding · RHEL ≥ 8, UBUNTU ≥ 22 · 1 impl
Description
The kernel parameter net.ipv6.conf.default.forwarding must be 0 on hosts that are not routers, so new interfaces do not forward ipv6 packets by default.
Rationale
Packet forwarding on a non-router host can bridge networks, bypass segmentation, or relay attack traffic. The per-interface default must be disabled unless the system is an authorized router.
Check → Remediate
Checksysctl_value
- key:
- net.ipv6.conf.default.forwarding
- expected:
- 0
Remediatesysctl_set
- key:
- net.ipv6.conf.default.forwarding
- value:
- 0
Framework references
CIS
rhel8 3.3.2.2rhel10 3.3.2.2ubuntu22 3.3.2.2ubuntu24 3.3.2.2
NIST 800-53
CM-6
Live verification
ubuntu22:checkubuntu24:check
#sysctl#networking#forwarding#hardening#cis