Back to Checks
gcp

Compute Engine VM instance has IP forwarding disabled

compute_instance_ip_forwarding_is_enabled
Service: computeSeverity: medium
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:compute.googleapis.com/Instance

Compute Engine VM instances with canIpForward enabled are identified. This setting allows a VM to process packets not addressed to its own IP.

Instances created by GKE (gke- prefix) are excluded from this evaluation.

Prowler logoProwlerprowler-provider-gcp

Risk

With IP forwarding a VM can route traffic for other addresses. If compromised, it can:

  • Spoof or tamper flows (integrity)
  • Intercept/redirect internal traffic (confidentiality)
  • Mask egress for exfiltration and enable lateral movement, degrading availability

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks compute_instance_ip_forwarding_is_enabled

Recommendation

Disable IP forwarding on general-purpose VMs and allow it only for vetted network appliances, following least privilege.

Enforce network segmentation, restrict routes, review exceptions regularly, and monitor egress to uphold defense in depth. Exclude platform-managed nodes that require forwarding.

Remediation

CLI

gcloud compute instances update-from-file <example_resource_name> --zone <ZONE> --source=<PATH_TO_CONFIG_WITH_canIpForward_false> --most-disruptive-allowed-action=RESTART

Terraform

resource "google_compute_instance" "<example_resource_name>" {
  name         = "<example_resource_name>"
  machine_type = "e2-micro"
  zone         = "<ZONE>"

  can_ip_forward = false  # Critical: disables IP forwarding to pass the check

  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-12"
    }
  }

  network_interface {
    network = "default"
  }
}

Other

1In Google Cloud console, go to Compute Engine > VM instances and select the VM (exclude names starting with gke-)
2Click Delete to remove the instance with IP forwarding enabled
3Click Create instance
4Expand Networking > Network interfaces > Edit and ensure IP forwarding is Off (default)
5Click Create

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.compute.compute_client import compute_client


class compute_instance_ip_forwarding_is_enabled(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for instance in compute_client.instances:
            report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
            report.status = "PASS"
            report.status_extended = (
                f"The IP Forwarding of VM Instance {instance.name} is not enabled."
            )
            if instance.ip_forward and instance.name[:4] != "gke-":
                report.status = "FAIL"
                report.status_extended = (
                    f"The IP Forwarding of VM Instance {instance.name} is enabled."
                )
            findings.append(report)

        return findings

References