Other Articles

Servers – Ensure Reverse Path Filtering is Enabled

Support > Fixing Checks > Server

06 March, 2026

This check ensures that Reverse Path Filtering is enabled on the server to prevent IP spoofing attacks.

Reverse path filtering verifies that incoming packets arrive on the correct network interface, helping to block malicious or spoofed traffic.

Check Details

  • Resource: Server
  • Check: Ensure Reverse Path Filtering is enabled
  • Risk: Disabled reverse path filtering allows spoofed packets, increasing risk of network-based attacks.

Remediation Steps

  1. Open a terminal session with root or sudo privileges.

  2. Verify current reverse path filtering settings:

    sysctl net.ipv4.conf.all.rp_filter
sysctl net.ipv4.conf.default.rp_filter
  3. Ensure both values are set to 1.

  4. Edit sysctl configuration file:

    sudo nano /etc/sysctl.conf

  5. Add or update the following lines:

    net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

  6. Apply the configuration changes:

    sudo sysctl -w net.ipv4.conf.all.rp_filter=1
sudo sysctl -w net.ipv4.conf.default.rp_filter=1
sudo sysctl -w net.ipv4.route.flush=1
  7. Verify the configuration again to ensure changes are applied.
  8. If your system uses asymmetrical routing (BGP, OSPF, etc.), enabling reverse path filtering may impact network functionality.