Netipv4ipforward

Net.ipv4.ip_forward is a Linux kernel parameter that controls IPv4 packet forwarding. When enabled, the kernel can forward IPv4 packets between network interfaces, allowing the host to function as a router or gateway. When disabled, the system will not route packets between interfaces, effectively acting as an end host.

Typically, net.ipv4.ip_forward is 0 by default on most distributions to avoid unintended routing. The value is exposed at /proc/sys/net/ipv4/ip_forward and can be read by cat.

To enable, use echo 1 > /proc/sys/net/ipv4/ip_forward or sysctl -w net.ipv4.ip_forward=1. To disable again, set to 0. Changes to /proc/sys are runtime only unless persisted.

To persist across reboots, set net.ipv4.ip_forward = 1 in /etc/sysctl.conf or add a file under /etc/sysctl.d with the line net.ipv4.ip_forward = 1, and reload with sysctl -p or reboot.

Even with IP forwarding enabled, traffic must be properly routed and permitted by the firewall. In practice, enabling forwarding is combined with routing tables and, for Internet-facing systems, Network Address Translation (NAT) rules such as iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE. On systems that act as routers, ensure routes exist for the intended networks and that security policies allow forwarding.

Disabling IP forwarding can mitigate exposure; only enable on systems serving as gateways or routers. In addition to IPv4, IPv6 uses net.ipv6.conf.all.forwarding for similar behavior.