A coworker claims that merely enabling IP_forwarding on a single homed Linux machine poses a security risk as he says it could then be used as a proxy.

I can't think of how this would work, except maybe if another machine on the same LAN set it as a gateway. Is there a risk here that I can't see?

  • 2
    Unless all public traffic is routed to this linux box from your current gateway/router, i doubt you have much to worry about. It looks like you have a good idea of what's going on. – David Houde May 3 '13 at 3:19

It would not work very well, as far as I can see. Proxying (as well as SNAT/masquerading) requires much more than simple IP forwarding.

Let's see, say that

  • is your network gateway
  • is Alice
  • is Eve

  • is Bob.

Eve sets Alice as her gateway, and pings Bob. The packet arrives to Alice who then forwards it to the real gateway, whence it would arrive to Bob marked as Eve's. Bob would answer and the reply would be sent directly to Eve, bypassing Alice.

So Bob will never know what happened, and will hold Eve responsible for what Eve did.

The only thing is that now Alice gets to eavesdrop one side of the conversation.

So now Eve forges a packet as coming from Alice. Alice receives a packet from her own address coming in from the outside, and in all probability she drops it.

Eve could forge a packet belonging to Charlie, but then, she could do this even before, without Alice's forwarding support. Actually, she could forge anyone in the local network; by setting Alice as the gateway, she is now worse off, for she can forge anyone except Alice.

If she has some way of foreseeing Bob's responses, she can engage in a blind spoofing of the conversation (but again, she could do this before), if she can make it so that Charlie does not respond by aborting the connection, and that the gateway doesn't inform Bob that Charlie's not reachable. Also, for connection protocols such as TCP, "foreseeing Bob's responses" is not all that easy unless Bob's TCP stack is vulnerable to prediction.

If the real gateway has security on it, now she can make it look as if Alice was forging a packet from Charlie, so that the real gateway spots the forgery and believes Alice to be responsible.

This last seems the most feasible "attack" that Alice exposes herself to by providing forwarding services.

  • +1 as I understand it, ip_forward is transparent, masquerading is what people should be worried about. – lynks May 3 '13 at 10:49

If it's single homed why would you enable IP_Forwarding? I would assume you would want to forward traffic from one nic to the other. If you had a multi-homed machine then your machine could potentially be used as a proxy into your network. I would call it a pivot point or a jump box into your internal network. But since there is only one interface I'm not sure why you would enable that function.

Your Answer

