Refuse source-routed packets

Why it matters

Source routing lets the sender of a packet dictate the path it takes. An attacker can use it to pull traffic through a machine they control, or to get around rules that depend on where packets are expected to arrive from. Almost no legitimate network uses it today.

How it works

Sets accept_source_route to 0 for IPv4 and IPv6 on the all and default interface groups. Packets that carry their own route are then dropped.

Who should use it

Suitable for practically everyone. Leave it off only for network testing or lab setups that deliberately use source-routed packets.

What you may notice

Nothing on ordinary networks. Only special diagnostic tools that use source routing are affected.

Check it on your computer

Read the current value:

sysctl net.ipv4.conf.all.accept_source_route
sysctl net.ipv4.conf.default.accept_source_route
sysctl net.ipv6.conf.all.accept_source_route
sysctl net.ipv6.conf.default.accept_source_route

Apply it by hand

Set it now (until the next restart):

sudo sysctl -w net.ipv4.conf.all.accept_source_route=0
sudo sysctl -w net.ipv4.conf.default.accept_source_route=0
sudo sysctl -w net.ipv6.conf.all.accept_source_route=0
sudo sysctl -w net.ipv6.conf.default.accept_source_route=0

Keep it after restarts, in a file you own:

sudo tee /etc/sysctl.d/90-net-source-routing.conf <<'EOF'
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0
EOF
sudo sysctl --system

Undo it

Remove the file and restart, or set the old value back with sysctl -w.

Related settings

• Ignore and never send ICMP redirects
• Drop packets with a forged sender address

Sources

Linux Hardening Guide (madaidans)

2.2.2

ANSSI, Configuration recommendations of a GNU/Linux system (BP-028)

kernel and network settings