---
title: Understanding IP Forwarding and Security
description: "When deploying load balancers, gateways, firewalls, or routers in a network, **IP forwarding** plays a critical role in how traffic flows. But with this flexibility comes responsibility — especially when it comes to security. This article explains what IP forwarding…"
url: "https://www.relianoid.com/resources/knowledge-base/misc/understanding-ip-forwarding-and-security/"
updated: "2025-07-21"
category: Misc
---

# Understanding IP Forwarding and Security

When deploying load balancers, gateways, firewalls, or routers in a network, **IP forwarding** plays a critical role in how traffic flows. But with this flexibility comes responsibility — especially when it comes to security.

This article explains what IP forwarding is, how it behaves in different load balancing scenarios (L4 vs L7), and what security best practices to follow — particularly when using **RELIANOID** with multiple network interfaces.

## What Is IP Forwarding?

**IP forwarding** is the ability of a system (like a Linux-based load balancer) to forward packets from one network interface to another — effectively routing packets that are not destined for the local machine.

![ip forwarding traffic flow](https://static.relianoid.com/wp-content/uploads/2025/07/IP-Forwarding-traffic-flow-1024x335.webp)

### Enabling IP Forwarding on Linux

To enable temporarily:

```
echo 1 > /proc/sys/net/ipv4/ip_forward
```

To enable permanently:

```
# Edit /etc/sysctl.conf
net.ipv4.ip_forward = 1

# Apply changes
sysctl -p
```

### Disabling IP Forwarding

To disable temporarily:

```
echo 0 > /proc/sys/net/ipv4/ip_forward
```

To disable permanently:

```
# Edit /etc/sysctl.conf
net.ipv4.ip_forward = 0

# Apply changes
sysctl -p
```

## Security risks enabling IP Forwarding

Enabling IP forwarding in load balancers (or any Linux-based network device) can introduce security concerns if not carefully configured. Here’s a breakdown of what those concerns are and how to mitigate them.

### Unintended Routing / Backdoor Access

If IP forwarding is enabled without strict firewall rules, your system could unintentionally route traffic between interfaces (e.g., internal to external), acting as a bridge between isolated networks.

### Source IP Spoofing

If the load balancer forwards packets without validating source addresses, an attacker could spoof source IPs, causing issues with logging, rate-limiting, or bypassing ACLs on backend systems.

### Open Relay for Packet Forwarding

A misconfigured system could forward arbitrary packets between interfaces, making the load balancer a packet relay, usable in DDoS amplification attacks or data exfiltration.

### Exposure to L3 Attacks (e.g., SYN Floods, Smurf Attacks)

A forwarding-enabled load balancer can be used in certain layer 3 or 4 attacks, especially if it's not protected by rate-limiting or proper filtering.

### Bypassing Security Appliances

If IP forwarding routes traffic around your firewall or IDS/IPS, malicious traffic might bypass inspection.

## How RELIANOID Uses IP Forwarding

When **RELIANOID Load Balancer** is configured with **multiple network interfaces**, IP forwarding is **enabled by default**. This allows the system to reduce routing hops and internally select the shortest path to backends, improving performance in NAT and multi-subnet configurations.

## IP Forwarding: When It’s Required (and When It’s Not)

| Load Balancer Mode | IP Forwarding Required? |
| --- | --- |
| L4 (Transport Layer) | Required if VIP and backends are on different subnets (e.g., NAT/DNAT topologies) |
| L7 (HTTP/S Proxy) | Not required, as the proxy terminates and re-initiates connections per hop |

## Security Best Practices When IP Forwarding Must Be Enabled

If your infrastructure requires IP forwarding, consider the following hardening strategies:

### Set Interfaces Routing to Unmanaged in RELIANOID

In *Networking > Routing*, switch from **Managed** to **Unmanaged** mode. This prevents internal routing table management and lateral path discovery.

### Use Microsegmentation

Define explicit endpoint-to-endpoint access rules using firewalls or security groups. Only permit traffic between authorized components (e.g., VIP ↔ backend).

### Implement VLAN Tagging

Enforce Layer 2 segmentation using VLANs to isolate internal/external traffic paths and restrict access at the hardware level.

While IP forwarding can be necessary — especially for L4 traffic or multi-interface setups — it also introduces risks. By combining RELIANOID's **Unmanaged Routing** mode with network segmentation strategies like VLANs and microsegmentation, organizations can achieve both performance and strong security.

### 📄 Download this document in PDF format