F30: ip_forward = 1 (verify need) #6

New issue

Open

opened 2026-05-06 10:56:41 +01:00 by s8n · 0 comments

s8n commented

2026-05-06 10:56:41 +01:00

Owner

Severity: Low–Medium
Status: Verify

net.ipv4.ip_forward = 1 on host. Needed if Docker bridge or Tailscale routing forwards packets between interfaces. May be unnecessary depending on actual mesh topology.

Fix: Determine if forwarding is required (likely yes for Headscale + container egress). If yes, document the rationale; if no, set ip_forward=0 and confirm Docker still functions.

Verification: sysctl net.ipv4.ip_forward matches documented decision; mesh + container egress still work post-change.

Source: security/nullstone-server/2026-05-02.md §F30.

**Severity:** Low–Medium **Status:** Verify `net.ipv4.ip_forward = 1` on host. Needed if Docker bridge or Tailscale routing forwards packets between interfaces. May be unnecessary depending on actual mesh topology. **Fix:** Determine if forwarding is required (likely yes for Headscale + container egress). If yes, document the rationale; if no, set `ip_forward=0` and confirm Docker still functions. **Verification:** `sysctl net.ipv4.ip_forward` matches documented decision; mesh + container egress still work post-change. Source: `security/nullstone-server/2026-05-02.md` §F30.