Compute Engine instances should have IP forwarding disabled
Instances must not have IP forwarding enabled, which means the attribute `can_ip_forward` must not be true. Disabling IP forwarding ensures the instance can only receive packets addressed to the instance.
With IP forwarding a VM can route traffic for other addresses. If compromised, it can: Spoof or tamper flows (integrity). It can also intercept/redirect internal traffic (confidentiality).
What this control checks
can_ip_forward must not be true on Compute Engine instances (gke- instances excluded).
Common pitfalls
GKE-created instances (gke- prefix) are skipped
Instances created by GKE, which have the gke- prefix, are excluded from this evaluation.
Template instances without can_ip_forward cannot PASS
If source_instance_template is set (indicating a google_compute_instance_from_template) and can_ip_forward is not present, this check cannot PASS, since the underlying source template is unknown.
Audit evidence
Evidence that deployed resources meet this control: Prowler check compute_instance_ip_forwarding_is_enabled (prowler gcp --checks compute_instance_ip_forwarding_is_enabled); PowerPipe control gcp_compliance.control.compute_instance_ip_forwarding_disabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_36; KICS query "IP Forwarding Enabled" (f34c0c25-47b4-41eb-9c79-249b4dd47b89); Trivy check GCP-0043.
Framework-specific interpretation
SOC 2: Mapped to CC6.6 (The entity implements logical access security measures to protect against threats from sources outside its system...).
PCI DSS v4.0: Mapped to 1.4.5 (Network connections between trusted and untrusted networks are controlled.).
NIST SP 800-53 Rev 5: Mapped to CA-9 (Internal System Connections) and SC-7 (Boundary Protection).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
- 1.4.5 The disclosure of internal IP addresses and routing information is limited to only authorized parties
- CA-9 Internal System Connections
- SC-7: Boundary Protection
- 4.6 Ensure That IP Forwarding Is Not Enabled on Instances
- 4.6 Ensure That IP Forwarding Is Not Enabled on Instances
- OIS-08.02B The following aspects are taken into account when identifying risks, insofar as they are applicable to the cloud service provided and are within the area of responsibility of the cloud service provider: - Processing, storage or transmission of cloud service customer data and cloud...
- 4.6 Ensure that IP forwarding is not enabled on Instances
- 4.6 Ensure that IP forwarding is not enabled on Instances
- 4.6 Ensure that IP forwarding is not enabled on Instances
Related controls
- Compute Engine instance templates should have IP forwarding disabled
- Compute Engine instances should have a single network interface
- Compute Engine instances should have deletion protection enabled
- Compute Engine instances should have high-level basic roles restricted
- Firewall rules should prohibit unrestricted SSH access from the internet
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_instance_ip_forwarding_disabled - Checkov Check:
CKV_GCP_36 - Powerpipe Control:
gcp_compliance.control.compute_instance_ip_forwarding_disabled - Prowler Check:
compute_instance_ip_forwarding_is_enabled - KICS Query:
f34c0c25-47b4-41eb-9c79-249b4dd47b89 - Trivy Check:
GCP-0043
Last reviewed: 2026-10-09