IP forwarding on your virtual machine should be disabled

What does the recommendation "IP forwarding on your virtual machine should be disabled" check?

Flags any virtual machine whose attached network interface has the 'enableIPForwarding' property set to true. That setting lets the VM receive packets addressed to other destinations and emit packets with a source address that is not its own, which is the behaviour a router or network virtual appliance needs but a normal workload does not. The control reads the NIC property only. It does not inspect the guest operating system, so a Linux box with net.ipv4.ip_forward enabled inside the kernel but IP forwarding switched off on the Azure NIC will not be flagged, and it does not evaluate route tables, NSG rules or whether forwarding is actually being used.

Why does "IP forwarding on your virtual machine should be disabled" matter?

A VM with IP forwarding left on can act as an unintended transit hop. If it is compromised, an attacker can route traffic through it to reach subnets the VM can see but the attacker cannot reach directly, for example a database tier that is only reachable from the app subnet, turning one foothold into lateral movement across your network. It also lets the machine emit packets with a forged source address, which undermines NSG rules, peering controls and flow logs that all assume the source IP is genuine. Most VMs have the flag enabled by mistake, copied from a marketplace image or an appliance template, or left over from a networking experiment, so the workload gains routing powers it never uses. Disabling it removes an avenue for pivoting and source spoofing at no cost to a machine that was never meant to forward packets, and it tightens the blast radius if that VM is breached.

How do I fix "IP forwarding on your virtual machine should be disabled"?

1. Confirm the VM is not a router or network virtual appliance, then disable forwarding on its network interface: az network nic update --name <nic-name> --resource-group <rg> --ip-forwarding false, which sets enableIPForwarding to false on the NIC.
2. In Bicep or ARM, set enableIPForwarding to false on the Microsoft.Network/networkInterfaces resource so new interfaces ship with forwarding off, and keep it off in your deployment templates.
3. Enforce it at scale by assigning the built-in audit policy by its definition id: az policy assignment create --name ip-forwarding-audit --policy bd352bd5-2853-4985-bf0d-73806b4a5744 --scope <scope>, so future VMs that re-enable forwarding are surfaced automatically.

# 1. Close the highest-impact exposure first: delete any rule that
#    allows a management port from the whole internet.
for rule in $(az network nsg rule list -g prod-rg --nsg-name prod-nsg \
    --query "[?access=='Allow' && (sourceAddressPrefix=='*' || sourceAddressPrefix=='Internet') && (destinationPortRange=='3389' || destinationPortRange=='22')].name" -o tsv); do
  az network nsg rule delete -g prod-rg --nsg-name prod-nsg -n "$rule"
  echo "$rule: open management-port rule removed"
done

# 2. Add an explicit deny on the management ports as a backstop.
az network nsg rule create -g prod-rg --nsg-name prod-nsg \
  --name deny-mgmt-ports --priority 4000 --access Deny --direction Inbound \
  --protocol Tcp --source-address-prefixes Internet \
  --destination-port-ranges 22 3389

# 3. Gate the ports you still need behind just-in-time access.
#    JIT is configured via PowerShell or the portal; request access with the CLI:
az security jit-policy list -o table   # confirm the JIT policy is in place

# 4. Ratchet it shut: audit any VM left without an NSG (Defender built-in policy).
az policy assignment create \
  --name audit-internet-facing-nsg \
  --policy f6de0be7-9a8a-4b8a-b349-43cf02d22f7c \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"