Remediation Guides

IP Forwarding Enabled: How to Disable It on Linux and Windows (Nessus 50686 and CIS)

26 September 2026 8 min read

IP Forwarding Enabled (Nessus plugin 50686, and the CIS benchmark check “Ensure IP forwarding is disabled”) means the host will pass packets between networks like a router. Unless it is meant to route, fix it by persistently setting net.ipv4.ip_forward and net.ipv6.conf.all.forwarding to 0 on Linux, or IPEnableRouter to 0 on Windows, then rescan.

What the scanner is actually detecting

Two different checks report the same condition, and they work in different ways.

  • Nessus plugin 50686, “IP Forwarding Enabled”: a remote plugin in the Firewalls family, rated Medium (CVSS v2 5.8, CVSS v3 6.5, attack vector Adjacent Network) and mapped to CVE-1999-0511. It needs no credentials and has no plugin dependencies. It tests how the host behaves on the network rather than reading a configuration value. Tenable’s solution covers Linux (/proc/sys/net/ipv4/ip_forward), Windows (the IPEnableRouter registry value) and macOS (sysctl -w net.inet.ip.forwarding=0).
  • CIS benchmark item “Ensure IP forwarding is disabled”: a Level 1 item in the CIS Linux benchmarks (for example item 3.2.1 in CIS CentOS Linux 8 Workstation v2.0.0; the number varies by benchmark). A compliance scan reads the net.ipv4.ip_forward and net.ipv6.conf.all.forwarding kernel parameters and the sysctl files that set them. This needs an authenticated Linux scan over SSH.

The CVE record itself limits the issue to machines that are not routers or firewalls. That context is the key to triage: on a router it is expected behavior, on a database server it is a misconfiguration.

Real-world risk, stated honestly

This is a medium-severity finding, not an emergency. To abuse it, an attacker must already be on a network adjacent to the host, able to send traffic to it directly. They can then use the host as their gateway, and it will relay their packets to any network it can reach. Tenable notes that this may let traffic bypass some firewall, router or NAC filtering.

The risk is real on multi-homed hosts. A server with one interface in a user VLAN and another in a management, backup or storage network turns into an unofficial router across a boundary your firewalls were meant to enforce. On a single-homed server in a flat network, the gain for an attacker is much smaller. A host firewall that drops forwarded packets reduces it further, and Docker sets up exactly that kind of drop policy when it enables forwarding. The finding does not give anyone access to the host itself.

How to confirm it on the host

Linux

# Runtime values: 1 means forwarding is on
sysctl net.ipv4.ip_forward net.ipv6.conf.all.forwarding

# Any individual interface still allowed to forward
sysctl -a 2>/dev/null | grep -E '.forwarding = 1$'

# Which files set it at boot
grep -rE 'ip_forward|.forwarding' /etc/sysctl.conf /etc/sysctl.d/ /run/sysctl.d/ /usr/local/lib/sysctl.d/ /usr/lib/sysctl.d/ 2>/dev/null

# Interfaces that suggest forwarding is intentional (docker0, cni0, virbr0, wg0, tun0)
ip -br link

If IPv6 is disabled at boot, the IPv6 key does not exist and sysctl reports an error for it. The CIS item only applies the IPv6 part when IPv6 is enabled.

Windows

Get-ItemProperty -Path 'HKLM:SYSTEMCurrentControlSetServicesTcpipParameters' -Name IPEnableRouter

Get-NetIPInterface | Where-Object Forwarding -eq 'Enabled' |
  Format-Table ifIndex, InterfaceAlias, AddressFamily, Forwarding

Get-Service RemoteAccess, SharedAccess | Format-Table Name, Status, StartType

The registry value is the host-wide switch, but forwarding can also be enabled on individual interfaces. Features whose job is to route traffic, such as Routing and Remote Access (RemoteAccess) and Internet Connection Sharing (SharedAccess), explain most results on Windows.

How to fix it

First decide whether the host is supposed to route. If it runs containers, Kubernetes, a VPN endpoint or NAT, skip to the exceptions section below.

Linux (any distribution using sysctl.d)

cat > /etc/sysctl.d/60-disable-ip-forwarding.conf <<'EOF'
net.ipv4.ip_forward = 0
net.ipv6.conf.all.forwarding = 0
EOF

sysctl --system
sysctl -w net.ipv4.route.flush=1
sysctl -w net.ipv6.route.flush=1

This matches the CIS remediation, which writes the values to a file under /etc/sysctl.d/ and applies them at runtime. Two details decide whether it sticks:

  • Precedence. At boot, systemd-sysctl sorts all files by filename across /etc/sysctl.d/, /run/sysctl.d/, /usr/local/lib/sysctl.d/ and /usr/lib/sysctl.d/, and the file with the latest name wins. sysctl --system also reads /etc/sysctl.conf last. If the grep above found ip_forward = 1 in a 99-*.conf file or in /etc/sysctl.conf, remove or comment out that line, or your setting will be overwritten.
  • Side effects of the change. The kernel documentation warns that changing ip_forward resets other IPv4 parameters to their host or router defaults. If you apply other network hardening through sysctl files, run sysctl --system once more after the first change and recheck those values.

Windows

reg add "HKLMSYSTEMCurrentControlSetServicesTcpipParameters" /v IPEnableRouter /t REG_DWORD /d 0 /f

Microsoft documents IPEnableRouter as a REG_DWORD whose default is 0, and TCP/IP registry changes need a restart to take effect. If an individual interface still shows forwarding enabled, disable it directly (the interface index comes from the check above):

Set-NetIPInterface -InterfaceIndex 12 -AddressFamily IPv4 -Forwarding Disabled

If RRAS or ICS is running on a server that should not route, removing or disabling that role is the real fix. Otherwise it may turn forwarding back on. For fleets, deploy the registry value with Group Policy Preferences: Computer Configuration > Preferences > Windows Settings > Registry, action Update, hive HKEY_LOCAL_MACHINE, key SYSTEMCurrentControlSetServicesTcpipParameters, value IPEnableRouter, REG_DWORD 0.

Hosts that must forward

Some systems depend on forwarding. Docker’s documentation states that the daemon turns on net.ipv4.ip_forward and net.ipv6.conf.all.forwarding when it starts, if they are not already on. The Kubernetes container runtime prerequisites require net.ipv4.ip_forward = 1 on nodes. VPN gateways, NAT gateways and virtualization hosts with NAT networks need forwarding too. For these hosts, keep forwarding on and control what it can do: a default-drop policy on forwarded traffic, allow rules only for the intended paths, and a documented exception.

How to verify the fix and rescan

  1. On Linux, sysctl net.ipv4.ip_forward net.ipv6.conf.all.forwarding should print 0 for both, and the sysctl -a grep should return no interfaces.
  2. Reboot one host and check again. This is how you catch a later sysctl file or a service that turns forwarding back on.
  3. On Windows, after the reboot, confirm that the registry value reads 0 and that Get-NetIPInterface shows no unexpected interfaces with forwarding enabled.
  4. For an independent network test, run Nmap’s ip-forwarding script from a machine on the same LAN. It needs root, and it needs a target that answers ping and is reachable through the scanned host: sudo nmap -sn 192.0.2.10 --script ip-forwarding --script-args ip-forwarding.target=198.51.100.20
  5. Rescan with the same scanner, policy and network position that raised the finding, and re-run the credentialed CIS compliance audit.

What can break and how to roll back

  • Containers and clusters. Containers on bridge networks lose outside connectivity, and Kubernetes pod networking fails. On a Docker host, the daemon turns forwarding back on the next time it starts.
  • Gateways and shared connections. VPN clients behind a gateway, NAT’d virtual machines, and Windows RRAS or ICS clients stop reaching other networks.
  • IPv6 behavior changes. The kernel documentation explains that with conf/all/forwarding at 0, Linux behaves as an IPv6 host. It sends Router Solicitations and accepts Router Advertisements (if accept_ra allows it), so a former router may start picking up addresses or default routes from the LAN.

Rolling back is quick:

# Linux
rm /etc/sysctl.d/60-disable-ip-forwarding.conf
sysctl -w net.ipv4.ip_forward=1
sysctl -w net.ipv6.conf.all.forwarding=1

# Windows (reboot afterwards)
reg add "HKLMSYSTEMCurrentControlSetServicesTcpipParameters" /v IPEnableRouter /t REG_DWORD /d 1 /f
Set-NetIPInterface -InterfaceIndex 12 -AddressFamily IPv4 -Forwarding Enabled

Common false positive reasons

  • The host is a router by design. Firewalls, VPN concentrators and NAT gateways are supposed to forward. Mark the finding as expected behavior and record why.
  • Intentional forwarding on container and Kubernetes hosts. Technically these findings are accurate, but the forwarding is required. Handle them through a formal risk acceptance with forward-chain filtering as the compensating control, not by excluding the host from scans.
  • The scanned IP belongs to another device. A load balancer virtual IP, firewall cluster address or NAT device can answer for the address. In that case the appliance is the one forwarding.
  • Configuration and runtime disagree. The CIS check can fail because no file sets the value persistently, even when the runtime value is already 0. The reverse also happens: a file says 0, but a service sets 1 after boot.
  • Per-interface forwarding. On Linux, an interface-level net.ipv4.conf.<interface>.forwarding = 1 controls whether packets arriving on that interface are forwarded. On Windows, individual interfaces can forward even when IPEnableRouter is 0.
  • No reboot or stale data. The Windows registry value was changed but the host has not restarted, or the report predates the fix.

FAQ

Is IP forwarding enabled a real vulnerability?

Yes, on a host that is not meant to route. It matters most on hosts connected to more than one network. On a dedicated router it is normal behavior and not a finding.

Do I need to reboot after disabling IP forwarding?

Not on Linux, where sysctl --system applies the change immediately. On Windows, the IPEnableRouter change takes effect after a restart.

Does net.ipv4.ip_forward=0 also disable IPv6 forwarding?

No. IPv6 is controlled separately by net.ipv6.conf.all.forwarding, and the CIS item expects both to be 0 when IPv6 is enabled.

Why does forwarding come back after a reboot?

Usually another sysctl file with a later name sets it to 1, or a service such as Docker enables it when it starts. Use the grep command above to find the file, and treat container hosts as documented exceptions.

Tracking this finding across many hosts

SITEY is a self-hosted vulnerability management platform that imports findings from 16 scanners. Nessus results come in when you upload a .nessus export. It can generate host-specific remediation scripts that run only after human approval, deployed by its agents on Windows and Linux endpoints. For Nessus findings such as plugin 50686, it can then retest the individual finding to confirm it is closed.

Sources

SITEY closes the loop, not just the report.Discover, validate, fix and verify in your own infrastructure.

See pricing
← All articles