Defensive Sysctl Parameters for Production IP Stacks

Sep 2, 2026 4 min read cybersecurity, Development

Linux distributions ship with kernel network configurations tuned for generic local networks. On public-facing infrastructure, these legacy defaults leave servers exposed to route poisoning, IP address spoofing, and resource starvation during SYN floods. Applying defensive sysctl overrides at boot establishes a baseline barrier before packets reach userspace proxies or firewalls.

Packet filtering at the firewall does not replace kernel-level sanity checks. Sysctl parameters instruct the IP stack to drop malformed or malicious packets before they consume socket buffers.

Checklist

net.ipv4.tcp_syncookies = 1: Enables SYN cookies when the socket backlog queue fills up. Instead of allocating memory in the connection tracking table for half-open handshakes, the kernel encodes connection state into the initial sequence number. This keeps the port responsive during volumetric TCP connection floods without dropping legitimate clients.
net.ipv4.conf.all.rp_filter = 1: Enforces strict Reverse Path Filtering across all network interfaces. The kernel verifies whether the incoming packet source IP matches a route reachable through the interface it arrived on. Packets with spoofed source addresses or unroutable origins get dropped immediately at the driver boundary.
net.ipv4.conf.all.accept_redirects = 0: Rejects ICMP redirect messages on all network interfaces. Attackers on shared or upstream segments can forge ICMP type 5 packets to trick the host routing table into sending traffic through a malicious gateway. Disabling redirects prevents local on-path routing manipulation.
net.ipv4.conf.all.send_redirects = 0: Stops the host from generating ICMP redirect notifications. Non-router servers have no reason to instruct other network devices on optimal routing paths. Disabling outbound redirects reduces unnecessary packet emission and prevents reconnaissance scripts from mapping internal subnet topology.
net.ipv4.conf.all.accept_source_route = 0: Drops IPv4 packets containing strict or loose source routing options. Source routing allows the sender to specify the exact hop-by-hop path through intermediate gateways, potentially bypassing perimeter firewalls. Modern internet traffic relies on dynamic routing; source-routed packets are almost exclusively malicious.
net.ipv4.conf.all.log_martians = 1: Logs packets with impossible source or destination addresses to the kernel ring buffer. When the interface encounters reserved bogon addresses or packets claiming to originate from loopback on an external port, it logs the anomaly to dmesg for intrusion visibility and firewall debugging.
net.ipv4.icmp_echo_ignore_broadcasts = 1: Drops ICMP echo requests sent to broadcast or multicast addresses. This stops the server from participating in distributed denial-of-service amplification schemes, such as Smurf attacks, where an adversary floods a broadcast subnet using a spoofed victim source address.
net.ipv4.icmp_ignore_bogus_error_responses = 1: Discards malformed ICMP error packets that violate RFC 1122. Attackers generate invalid responses to fill kernel memory and pollute syslog storage. Enabling this parameter prevents CPU cycles from being wasted on invalid status payloads.
net.ipv4.tcp_rfc1337 = 1: Implements RFC 1337 mitigation against TCP TIME_WAIT assassination. In standard operation, receiving a stray or forged RST packet during TIME_WAIT can close the socket prematurely, allowing delayed duplicates from old connections to corrupt new sessions. This directive drops RST packets targeted at sockets in TIME_WAIT.
net.ipv4.tcp_timestamps = 0: Disables TCP timestamp headers defined in RFC 1323. TCP timestamps include uptime counter values in every packet header, giving remote port scanners an accurate method to calculate system uptime, reboot history, and kernel patch cycles without authentication.

# Persist network hardening rules
sudo tee /etc/sysctl.d/99-network-hardening.conf <<'EOF'
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.tcp_rfc1337 = 1
net.ipv4.tcp_timestamps = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0
EOF

# Load and verify settings immediately
sudo sysctl --system
sysctl net.ipv4.tcp_syncookies net.ipv4.conf.all.rp_filter net.ipv4.tcp_rfc1337

Kernel configuration files placed under /etc/sysctl.d/ apply deterministically across reboots and kernel upgrades. Setting both all and default interface variants ensures newly created virtual interfaces, bridge endpoints, and container veth pairs inherit the hardened security baseline automatically.