How RP Filter Works on Linux

RP filter (Reverse Path Filtering) is a Linux kernel security feature that helps prevent IP spoofing by verifying that the source address of incoming packets is reachable through the interface they arrived on. This guide explains how it works and how to configure it on your system.

What You’ll Need

• A Linux system with root or sudo access
• Basic familiarity with the command line
• Knowledge of your network interfaces (e.g., eth0, wlan0) and their IP configurations

Step-by-Step

1. Check current RP filter settings
   Run sysctl net.ipv4.conf.all.rp_filter and sysctl net.ipv4.conf.default.rp_filter. The output shows the current value (0, 1, or 2) for all interfaces and for new interfaces created later.
2. Understand the three modes
   • 0 – Disabled: no reverse path check is performed.
   • 1 – Strict mode: the source address must be reachable via the interface it arrived on, and the route must be the best route (the one the kernel would use to send a reply).
   • 2 – Loose mode: the source address must be reachable via any interface on the system, not necessarily the one it arrived on.
3. Enable RP filter temporarily
   To set strict mode immediately (until reboot), run: sudo sysctl -w net.ipv4.conf.all.rp_filter=1. Replace 1 with 2 for loose mode or 0 to disable.
4. Apply to specific interfaces
   Use net.ipv4.conf.<interface>.rp_filter instead of all to target a single interface, e.g., sudo sysctl -w net.ipv4.conf.eth0.rp_filter=1. Note that the all setting acts as a maximum; the effective value is the maximum of all and the specific interface setting.
5. Make changes permanent
   Edit /etc/sysctl.conf or a file in /etc/sysctl.d/ (e.g., /etc/sysctl.d/99-rp-filter.conf) and add lines like net.ipv4.conf.all.rp_filter=1 and net.ipv4.conf.default.rp_filter=1. Then run sudo sysctl --system to apply.
6. Verify the change
   Run sysctl net.ipv4.conf.all.rp_filter again to confirm the new value. Also check per-interface settings with sysctl net.ipv4.conf.eth0.rp_filter if needed.
7. Test with a packet capture (optional)
   Use tcpdump or wireshark to observe incoming packets. If RP filter is working, spoofed packets from unroutable source addresses should be dropped before reaching applications.

Common Mistakes

• Forgetting the all vs per-interface interaction: The kernel takes the maximum of the all value and the interface-specific value. If you set all to 0 but an interface to 1, that interface still uses 1.
• Using loose mode when strict is needed: Loose mode is less secure; it only checks that the source is reachable via any route, which may allow spoofing in multi-homed setups.
• Not making changes permanent: Running sysctl -w only affects the current session; a reboot resets it unless you edit configuration files.
• Confusing with iptables: RP filter is a kernel-level check, not a firewall rule. It works independently of iptables/nftables.

Tips

• Use strict mode (1) on single-homed hosts (e.g., typical desktop or server with one internet connection) for maximum spoofing protection.
• Use loose mode (2) on multi-homed systems (e.g., routers with multiple upstreams) where strict mode might drop legitimate asymmetric traffic.
• If you have asymmetric routing (packets arrive on one interface but replies go out another), strict mode will drop them. Consider loose mode or disabling RP filter on that interface.
• Set net.ipv4.conf.default.rp_filter so that new interfaces (like VPN tunnels) inherit the desired setting.
• Check your distribution’s documentation; some have their own network configuration tools that may override sysctl settings.

Troubleshooting

• Legitimate traffic is being dropped: If you notice packets lost, check if RP filter is causing it. Temporarily set rp_filter=0 on the affected interface and see if the problem disappears. If so, switch to loose mode (2) or adjust routing.
• Changes don’t persist after reboot: Ensure you edited the correct sysctl file and that the file is read. Run sysctl --system to apply and verify with sysctl.
• RP filter appears disabled even after enabling: Check if your distribution’s network manager (NetworkManager, systemd-networkd) resets sysctl values. You may need to set it in the network configuration or a systemd service.
• Cannot set value due to read-only sysctl: Some sysctls are read-only in certain contexts (e.g., in containers). You may need to run with full root privileges or adjust the container’s sysctl settings.
• Packets still pass with RP filter enabled: Ensure the filter is actually applied to the interface in question; check sysctl net.ipv4.conf.<iface>.rp_filter and remember the all max rule.

Frequently Asked Questions

What does rp_filter=1 actually do?

In strict mode, when a packet arrives on an interface, the kernel checks if the source IP address is reachable via that same interface according to the routing table. If not, the packet is dropped. This blocks spoofed packets that claim a source IP from a different network.

Is RP filter enabled by default?

Many Linux distributions enable it by default, but it varies. Check with sysctl net.ipv4.conf.all.rp_filter. If it returns 0, it’s disabled.

What’s the difference between rp_filter and iptables?

RP filter is a kernel-level route validation that happens before iptables. iptables can also filter packets, but RP filter is simpler and faster for spoofing prevention. They can be used together.

Can I enable RP filter on a VPN interface?

Yes, you can set it per interface. However, VPN interfaces often have special routing, so test carefully. Loose mode might be safer for VPNs to avoid dropping legitimate traffic.

Does RP filter affect IPv6?

No, RP filter applies only to IPv4. IPv6 has its own mechanisms, but the sysctl is IPv4-specific.

How do I check if RP filter is working?

You can send a packet with a spoofed source IP from another machine and see if it’s received. Use tcpdump to monitor the interface. If RP filter is active, the spoofed packet should not appear in the capture.

Related

• Hide Facebook Marketplace Listings From Specific People
• Send Outlook Availability Without Switching Apps
• Crashing Shockwave Flash on Chrome? Fixes That Work