Drop packets with a forged sender address

Why it matters

Attackers often put a false sender address on packets, either to hide who they are or to pass as a trusted machine. Reverse path filtering checks whether a reply to that address would go out the same network link the packet arrived on. If it would not, the packet is dropped.

How it works

Sets net.ipv4.conf.all.rp_filter and net.ipv4.conf.default.rp_filter to 1, which is strict mode. A packet is accepted only if the best route back to its source goes through the interface it came in on.

Who should use it

Good for ordinary single-connection computers and simple servers. Leave it off, or use loose mode (2), on machines with several network links, policy routing, or some VPN setups.

What you may notice

Connections that work on one network path fail on another, or a VPN stops passing traffic. Dropped packets are counted by nstat as IPReversePathFilter, which points to this setting.

Check it on your computer

Read the current value:

sysctl net.ipv4.conf.all.rp_filter
sysctl net.ipv4.conf.default.rp_filter

Apply it by hand

Set it now (until the next restart):

sudo sysctl -w net.ipv4.conf.all.rp_filter=1
sudo sysctl -w net.ipv4.conf.default.rp_filter=1

Keep it after restarts, in a file you own:

sudo tee /etc/sysctl.d/90-net-rp-filter.conf <<'EOF'
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
EOF
sudo sysctl --system

Undo it

Remove the file and restart, or set the old value back with sysctl -w.

Related settings

• Ignore and never send ICMP redirects
• Refuse source-routed packets

Sources

Linux Hardening Guide (madaidans)

2.2.2

Linux kernel documentation

net