Compute Engine VM instance has IP forwarding disabled

Check ID: compute_instance_ip_forwarding_is_enabled
Provider: GCP
Service: compute
Severity: MEDIUM
Categories: trust-boundaries
Resource type: compute.googleapis.com/Instance

What this check verifies

Compute Engine VM instances with canIpForward enabled are identified. This setting allows a VM to process packets not addressed to its own IP. Instances created by GKE (gke- prefix) are excluded from this evaluation.

Risk

With IP forwarding a VM can route traffic for other addresses. If compromised, it can:

Spoof or tamper flows (integrity)
Intercept/redirect internal traffic (confidentiality)
Mask egress for exfiltration and enable lateral movement, degrading availability

Recommendation

Disable IP forwarding on general-purpose VMs and allow it only for vetted network appliances, following least privilege. Enforce network segmentation, restrict routes, review exceptions regularly, and monitor egress to uphold defense in depth. Exclude platform-managed nodes that require forwarding.

Remediation

CLI
Terraform
Dashboard steps

gcloud compute instances update-from-file <example_resource_name> --zone <ZONE> --source=<PATH_TO_CONFIG_WITH_canIpForward_false> --most-disruptive-allowed-action=RESTART

resource "google_compute_instance" "<example_resource_name>" {
  name         = "<example_resource_name>"
  machine_type = "e2-micro"
  zone         = "<ZONE>"

  can_ip_forward = false  # Critical: disables IP forwarding to pass the check

  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-12"
    }
  }

  network_interface {
    network = "default"
  }
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_instance_ip_forwarding_is_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Managed Instance Groups span multiple zones Compute VM On Host Maintenance is set to MIGRATE

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires