Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
Forces net.ipv4.conf.default.rp_filter to 1 (strict reverse path filtering) so newly created IPv4 interfaces drop packets with unverifiable source addresses by default.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Reverse Path Filtering (RPF) makes the kernel verify that an incoming packet's source address is reachable through the interface it arrived on; otherwise the packet is dropped. This defeats IP spoofing and asymmetric-route attacks. The default template should be 1 (strict) so every interface created after boot inherits spoofing protection. Strict RPF suits end hosts and routers on simple, symmetric topologies; multi-homed routers with asymmetric routing may need loose mode (2) to avoid dropping legitimate return traffic.
What Pavois checks
Pavois reads the live runtime value of net.ipv4.conf.default.rp_filter from the kernel (InSpec kernel_parameter, equivalent to sysctl), not a /etc/sysctl.d/ file. The default key sets the template inherited by interfaces created later, so the running value is what determines future interfaces' spoofing protection. A drop-in might declare 1 while a later override left it at 0 or 2; only the effective parameter is authoritative.
describe kernel_parameter('net.ipv4.conf.default.rp_filter') do
its('value') { should cmp 1 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv4.conf.default.rp_filter[[:space:]]*=[[:space:]]*1([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv4.conf.default.rp_filter. Expected output:
net.ipv4.conf.default.rp_filter = 1
Inspect & investigate
RPF drops are not logged unless log_martians is enabled; with it on, dropped spoofed packets appear via dmesg | grep -i martian and journalctl -k. Inspect the tunable state with sysctl net.ipv4.conf.default.rp_filter and per-interface values with sysctl -a | grep rp_filter.
Remediation
Pavois's harden plan uses the sysctl resource to set net.ipv4.conf.default.rp_filter to 1, applying it to the running kernel and persisting it in a Pavois-managed drop-in under /etc/sysctl.d/ so it survives reboot. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv4.conf.default.rp_filter |
|---|---|
| resource | sysctl |
| value | 1 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Strict RPF (1) is safe for the vast majority of hosts and is the recommended default. Caution on routers with asymmetric routing (multiple uplinks, multi-homing, some VPN/policy-routing setups): strict mode silently drops return traffic arriving on a different interface than the forward path, which can break connectivity. On such systems use loose mode (2). This is the default template; pair with the all.rp_filter rule. Before applying on a router, confirm routing is symmetric or test on a non-production node. No effect on a single-homed server's remote access.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R12 | direct | 2.0 | high |
| CIS | 3.3.7, 3.3.1.13 | direct | per OS, see the benchmark table | high |
| NIST | 3.1.20, CM-6(a), CM-7(a), CM-7(b), SC-7(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.