Other Articles

Servers – Ensure Reverse Path Filtering is Enabled

Secure Configuration Checks > Server

This check ensures that Reverse Path Filtering is enabled on the server to prevent IP spoofing attacks.

Reverse path filtering verifies that incoming packets arrive on the correct network interface, helping to block malicious or spoofed traffic.

Check Details

  • Resource: Server
  • Check: Ensure Reverse Path Filtering is enabled
  • Risk: Disabled reverse path filtering allows spoofed packets, increasing risk of network-based attacks.

Remediation Steps

  1. Open a terminal session with root or sudo privileges.

  2. Verify current reverse path filtering settings:

    sysctl net.ipv4.conf.all.rp_filter
sysctl net.ipv4.conf.default.rp_filter
  3. Ensure both values are set to 1.

  4. Edit sysctl configuration file:

    sudo nano /etc/sysctl.conf

  5. Add or update the following lines:

    net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

  6. Apply the configuration changes:

    sudo sysctl -w net.ipv4.conf.all.rp_filter=1
sudo sysctl -w net.ipv4.conf.default.rp_filter=1
sudo sysctl -w net.ipv4.route.flush=1
  7. Verify the configuration again to ensure changes are applied.
  8. If your system uses asymmetrical routing (BGP, OSPF, etc.), enabling reverse path filtering may impact network functionality.

Updated on 06 March, 2026