Ensure net.ipv6.conf.default.forwarding is set to 0

Description

The kernel parameter net.ipv6.conf.default.forwarding must be 0 on hosts that are not routers, so new interfaces do not forward ipv6 packets by default.

Rationale

Packet forwarding on a non-router host can bridge networks, bypass segmentation, or relay attack traffic. The per-interface default must be disabled unless the system is an authorized router.

Framework references