UCF STIG Viewer Logo

The system must use a reverse-path filter for IPv4 network traffic when possible by default.


Overview

Finding ID Version Rule ID IA Controls Severity
V-38544 RHEL-06-000097 SV-50345r2_rule Medium
Description
Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks.
STIG Date
Red Hat Enterprise Linux 6 Security Technical Implementation Guide 2015-09-09

Details

Check Text ( None )
None
Fix Text (F-43492r1_fix)
To set the runtime status of the "net.ipv4.conf.default.rp_filter" kernel parameter, run the following command:

# sysctl -w net.ipv4.conf.default.rp_filter=1

If this is not the system's default value, add the following line to "/etc/sysctl.conf":

net.ipv4.conf.default.rp_filter = 1