Other Articles

Servers – Ensure Secure ICMP Redirects are Disabled

Support > Fixing Checks > Server

06 March, 2026

This check ensures that secure ICMP redirects are not accepted on the server.

Accepting secure ICMP redirects can allow routing table updates from compromised gateways, increasing the risk of traffic manipulation.

Check Details

  • Resource: Server
  • Check: Ensure secure ICMP redirects are not accepted
  • Risk: Accepting redirects from even trusted gateways may allow attackers to manipulate routing tables if those gateways are compromised.

Remediation Steps

  1. Open a terminal session with root or sudo privileges.

  2. Set the active kernel parameters to disable secure ICMP redirects:

    sudo sysctl -w net.ipv4.conf.all.secure_redirects=0
sudo sysctl -w net.ipv4.conf.default.secure_redirects=0
sudo sysctl -w net.ipv4.route.flush=1

  3. Ensure the configuration persists after reboot by editing sysctl configuration:

    sudo nano /etc/sysctl.conf

  4. Add or update the following lines:

    net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0

  5. Apply the changes:

    sudo sysctl -p
  6. Re-run audit commands to confirm the configuration is correctly applied.